CVE-2024-6283 DethemeKit For Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery Widget

The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL parameter of the De Gallery widget in all versions up to and including 2.1.5 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible fo...

WordPress Portfolio Gallery – Image Gallery Plugin Plugin <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Portfolio Gallery – Image Gallery Plugin Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6262 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b1ed057446f2 Credits...

WordPress Plugin Portfolio Gallery Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Gallery Slideshow plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jean Tirstan T Patchstack Alliance in WordPress Plugin Gallery Slideshow versions = 1.4.1...

WordPress Gallery Slideshow Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)

Software Gallery Slideshow Type Plugin Vulnerable versions = 1.4.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37246 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a28f76862eae Credits Jean Tirstan T Required privilege...

CVE-2024-35770

Cross-Site Request Forgery CSRF vulnerability in Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin.This issue affects Vimeography: Vimeo Video Gallery WordPress Plugin: from n/a through 2.4.1...

CVE-2024-35770

Cross-Site Request Forgery CSRF vulnerability in Dave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin.This issue affects Vimeography: Vimeo Video Gallery WordPress Plugin: from n/a through 2.4.1...

WordPress Transition Slider – Responsive Image Slider and Gallery plugin <= 2.20.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Transition Slider – Responsive Image Slider and Gallery versions = 2.20.3...

WordPress Envira Photo Gallery plugin <= 1.8.7.3 - CSRF leading to notice dismissal vulnerability

CSRF leading to notice dismissal vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Envira Photo Gallery versions = 1.8.7.3...

WordPress Transition Slider – Responsive Image Slider and Gallery Plugin <= 2.20.3 is vulnerable to Cross Site Scripting (XSS)

Software Transition Slider – Responsive Image Slider and Gallery Type Plugin Vulnerable versions = 2.20.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37215 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 549d55c8caf1 Credits...

WordPress Envira Photo Gallery Plugin <= 1.8.7.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Envira Photo Gallery Type Plugin Vulnerable versions = 1.8.7.3 Fixed in 1.8.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37095 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 23e28f9edb47 Credits Abdi Pranata...

CVE-2024-3894 Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title

The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an Image Title in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-3894

CVE-2024-3894 is a Stored XSS flaw in the Photo Gallery, Images, Slider component of the WordPress Robo Gallery plugin (WordPress plugin: Robo Gallery; referenced as Photo Gallery, Images, Slider in Rbs Image Gallery). The root cause is insufficient input sanitization and output escaping for the ...

CVE-2024-3894 Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title

The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an Image Title in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-5343 Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Cross-Site Request Forgery to Post Creation and Limited Data Loss

The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.19. This is due to missing or incorrect nonce validation on the 'rbsajaxcreatearticle' and 'rbsajaxresetviews' functions. This makes it...

CVE-2024-5343

The CVE-2024-5343 issue affects Photo Gallery, Images, Slider in the Robo Gallery WordPress plugin. It is a Cross-Site Request Forgery (CSRF) vulnerability present in all versions up to 3.2.19 due to missing/incorrect nonce validation on two AJAX handlers: rbs_ajax_create_article and rbs_ajax_res...

CVE-2024-5343 Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Cross-Site Request Forgery to Post Creation and Limited Data Loss

The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.19. This is due to missing or incorrect nonce validation on the 'rbsajaxcreatearticle' and 'rbsajaxresetviews' functions. This makes it...

WordPress Robo Gallery plugin <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Image Title vulnerability discovered by Tim Coen in WordPress Plugin Robo Gallery versions = 3.2.19...

CVE-2024-5724 Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection

The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGMallphotosdetails' parameter. This makes it possible for authenticated attackers, with Contributor-level access and abov...

CVE-2024-5021

CVE-2024-5021 affects the WordPress Picture / Portfolio / Media Gallery (nimble-portfolio) plugin up to 3.0.1. It enables unauthenticated SSRF via file_get_contents, allowing requests to arbitrary locations from the web application and potentially accessing/modifying internal services. Patch stat...