696 matches found
WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting
WordPress HDW Video Gallery 1.2 and before contains a cross-site scripting vulnerability via playlist.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...
All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery
WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery SSRF via the 'dl' parameter found in the /public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the serve...
WordPress WP Video Gallery <=1.7.1 - SQL Injection
WordPress WP Video Gallery plugin through 1.7.1 contains a SQL injection vulnerability. The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...
Gallery-Plugin-SQL-Injection
Título del exploit: Wordpress Video Gallery - YouTube Gallery and Vimeo Gallery Plugin SQL Injection Fecha: 2024-07-05 Autor del exploit: tmrswrr Categoría: Webapps Página del proveedor: https://total-soft.com/wp-video-gallery/ Versión 2.3.6 1. Accede al panel de administración: Navega hasta el...
CVE-2026-10104-POC
CVE-2026-10104: Cross-Site Scripting Almacenado en Product Video Gallery para WooCommerce Resumen Detalle| Valor ---|--- ID CVE| CVE-2026-10104 Plugin| Product Video Gallery for WooCommerce Vendedor| TechnoSoft Webs NikHiL Gadhiya Tipo| Cross-Site Scripting Almacenado XSS CWE| CWE-79 —...
CVE-2024-52430
CVE-2024-52430 Lis Video Gallery = 0.2.1 - Inyección de Objetos PHP no Autenticada Descripción El plugin Lis Video Gallery para WordPress es vulnerable a la Inyección de Objetos PHP en versiones hasta la 0.2.1 inclusive, a través de la deserialización de entrada no confiable. Esto permite que...
CVE-2026-92713
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...
CVE-2026-89406
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...
EUVD-2026-86602
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...
CVE-2026-92713 Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...
EUVD-2026-86592
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...
WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability
Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Modula Image Gallery versions = 3.0.1...
WordPress All-in-One Video Gallery plugin < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter vulnerability
Subscriber+ Server-Side Request Forgery via 'vdl' Parameter vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin All-in-One Video Gallery versions 4.9.2...
CVE-2026-19075
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
EUVD-2026-54999
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-19075 All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-19075
The All-in-One Video Gallery WordPress plugin (versions < 4.9.2 ) is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the plugin registers a public, unauthenticated file-download handler via the ?vdl= parameter on aiovg_videos posts. Specifically, the AIOVG_Public_Vid...
CVE-2026-19075
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-19075 All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-19075: Server-Side Request Forgery (SSRF)
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...