CVE-2022-3991

Summary (MODE C): The WordPress Photospace Gallery plugin is affected by a Stored Cross-Site Scripting vulnerability in versions up to 2.3.5. The issue stems from insufficient input sanitization and output escaping in settings saved via the update() function, allowing authenticated users with sub...

CVE-2022-38135

CVE-2022-38135 concerns Dean Oakley’s Photospace Gallery WordPress plugin, affected up to version 2.3.5. The flaw is a Broken Access Control where users with a subscriber or higher role can change plugin settings, indicating missing authorization checks on settings updates. Affected: Photospace G...