WordPress Photo Gallery by 10Web Plugin <= 1.8.21 is vulnerable to Cross Site Scripting (XSS)

Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.21 Fixed in 1.8.22 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2296 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID db9d53f79206 Credits Jobert Krohnen...

WordPress NextGEN Gallery Plugin <= 3.59 is vulnerable to Broken Access Control

Software NextGEN Gallery Type Plugin Vulnerable versions = 3.59 Fixed in 3.59.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3097 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 1d6376e4869c Credits Peng Zhou Required privilege...

WordPress Slideshow Gallery LITE plugin <= 1.7.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Slideshow Gallery versions = 1.7.8...

WordPress Slideshow Gallery LITE plugin <= 1.7.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Slideshow Gallery versions = 1.7.8...

WordPress Slideshow Gallery LITE plugin <= 1.8 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Slideshow Gallery versions = 1.8...

WordPress Slideshow Gallery Plugin <= 1.7.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Slideshow Gallery Type Plugin Vulnerable versions = 1.7.8 Fixed in 1.7.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31354 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fa0ba59d923d Credits Ananda Dhakal...

WordPress Slideshow Gallery Plugin <= 1.8 is vulnerable to Sensitive Data Exposure

Software Slideshow Gallery Type Plugin Vulnerable versions = 1.8 Fixed in 1.8.1 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-31353 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 0d303a6f8dfd Credits Ananda Dhakal Patchstack...

WordPress Slideshow Gallery Plugin <= 1.7.8 is vulnerable to SQL Injection

Software Slideshow Gallery Type Plugin Vulnerable versions = 1.7.8 Fixed in 1.7.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-31355 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 6b8a2fec8ee3 Credits LVT-tholv2k Required privilege Contributor...

CVE-2024-2296 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.8.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-2296

CVE-2024-2296 affects Photo Gallery by 10Web – Mobile-Friendly Image Gallery (WordPress). It is a Stored XSS via SVG file uploads in version up to 1.8.21, caused by insufficient input sanitization and output escaping. Attack requires authenticated admin privileges and affects multisite installati...

CVE-2024-2949

The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel widget in all versions up to, and including, 2.6.3 due to...

CVE-2024-2949 Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode'

The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel widget in all versions up to, and including, 2.6.3 due to...

PT-2024-19630 · 10Web · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions up to, and including, 1.8.21 Description: The issue is related to Stored Cross-Site Scripting via SVG file uploads due to insufficient input sanitization...

WordPress Plugin Carousel, Slider, Gallery by WP Carousel 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Plugin Photo Gallery by 10Web 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Gallery Exporter plugin <= 1.3 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Abdi Prawira Negara Patchstack Alliance in WordPress Plugin WordPress Gallery Exporter versions = 1.3...

WordPress Responsive Lightbox & Gallery plugin <= 2.4.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by emad Patchstack Alliance in WordPress Plugin Responsive Lightbox versions = 2.4.6...

WordPress All-in-One Video Gallery plugin <= 3.5.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by emad Patchstack Alliance in WordPress Plugin All-in-One Video Gallery versions = 3.5.2...

WordPress WordPress Gallery Exporter Plugin <= 1.3 is vulnerable to Arbitrary File Download

Software WordPress Gallery Exporter Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-31342 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6307ae9c3c1f Credits Abdi Prawira Negara...

Sydney Toolbox < 1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery

Description The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 1.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...