WordPress NextGEN Gallery Plugin <= 3.59.3 is vulnerable to Cross Site Scripting (XSS)

Software NextGEN Gallery Type Plugin Vulnerable versions = 3.59.3 Fixed in 3.59.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39627 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6bbc30e7c26a Credits Ibnu Ubaeydillah Required privilege...

WordPress NextGEN Gallery plugin < 3.59.3 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin NextGEN Gallery versions 3.59.3...

WordPress Image Photo Gallery Final Tiles Grid plugin < 3.6.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Image Photo Gallery Final Tiles Grid versions 3.6.0...

WordPress Smart Image Gallery plugin < 1.0.19 - Update/Delete Google API Key via CSRF vulnerability

Update/Delete Google API Key via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Smart Image Gallery versions 1.0.19...

WordPress Image Photo Gallery Final Tiles Grid Plugin < 3.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Image Photo Gallery Final Tiles Grid Type Plugin Vulnerable versions 3.6.0 Fixed in 3.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3710 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID af002133dcff Credits Dmitr...

WordPress NextGEN Gallery Plugin < 3.59.3 is vulnerable to Cross Site Scripting (XSS)

Software NextGEN Gallery Type Plugin Vulnerable versions 3.59.3 Fixed in 3.59.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5442 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 16bde9ef9207 Credits Krugov Artyom Required...

WordPress Smart Image Gallery Plugin < 1.0.19 is vulnerable to Cross Site Request Forgery (CSRF)

Software Smart Image Gallery Type Plugin Vulnerable versions 1.0.19 Fixed in 1.0.19 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3632 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 13b040259b7b Credits Bob Matyas...

CVE-2024-5442

The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-3632

The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-3632

The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-3710

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be use...

CVE-2024-5442 NextGEN Gallery < 3.59.3 - Admin+ Stored XSS

The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-5442 NextGEN Gallery < 3.59.3 - Admin+ Stored XSS

The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-5442

Summary of CVE-2024-5442 (NextGEN Gallery) : The WordPress plugin NextGEN Gallery (versions before 3.59.3) contains sanitization/escaping flaws in settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., administrators) even when unfiltered_html is disallowed (such as in mult...

CVE-2024-3710

CVE-2024-3710 used details: The WordPress plugin “Image Photo Gallery Final Tiles Grid” (Final Tiles Grid Gallery Lite) is affected in versions before 3.6.0. The issue stems from insufficient validation/escaping of shortcode attributes, allowing Stored XSS when outputting attributes back into the...

CVE-2024-3632 Smart Image Gallery < 1.0.19 - Update/Delete Google API Key via CSRF

The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-3632

CVE-2024-3632 affects the WordPress plugin Smart Image Gallery prior to version 1.0.19. The vulnerability arises from a missing CSRF check when updating plugin settings, enabling a logged-in attacker to modify settings via a CSRF attack. Patch information from Patchstack indicates the fix is in 1...

CVE-2024-3632 Smart Image Gallery < 1.0.19 - Update/Delete Google API Key via CSRF

The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

PT-2024-26956 · WordPress · Smart Image Gallery

Name of the Vulnerable Software and Affected Versions: Smart Image Gallery WordPress plugin versions prior to 1.0.19 Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: F...

WordPress plugin NextGEN Gallery security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...