Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

776 results · page 12 of 16

Oct 31, 2023Left right image slideshow gallery: SQL InjectionCVE-2023-5431 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Left right image slideshow gallery
Affected
up to 12.0
What to do
Affects up to 12.0. Update Left right image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023WordPress Gallery: Does not validate some block attributes before using them to generate paths passed to include function/sCVE-2023-3279 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks
Product
WordPress Gallery
Fixed in
3.39
What to do
Update WordPress Gallery to 3.39 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023WordPress Gallery: Is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` functionCVE-2023-3155 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
Product
WordPress Gallery
Fixed in
3.39
What to do
Update WordPress Gallery to 3.39 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023WordPress Gallery: Is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` functionCVE-2023-3154 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
Product
WordPress Gallery
Fixed in
3.39
What to do
Update WordPress Gallery to 3.39 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in 10 Quality Post Gallery plugin <= 2.3.12 versions.CVE-2023-45752 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in 10 Quality Post Gallery plugin <= 2.3.12 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.CVE-2023-45629 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Hardik Kalathiya WP Gallery Metabox plugin <= 1.0.0 versions.CVE-2023-41876 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hardik Kalathiya WP Gallery Metabox plugin <= 1.0.0 versions.
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions.CVE-2023-44233 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions.
Affected
up to 2.2.44
What to do
Affects up to 2.2.44. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Jules Colle, BDWM Responsive Gallery Grid plugin <= 2.3.10 versions.CVE-2023-41659 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Jules Colle, BDWM Responsive Gallery Grid plugin <= 2.3.10 versions.
Affected
up to 2.3.10
What to do
Affects up to 2.3.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions.CVE-2023-40558 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions.
Fixed in
3.3.6
What to do
Update the plugin to 3.3.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.2.6 versions.CVE-2023-39917 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.2.6 versions.
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 4, 2023Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2023-3499 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.16
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 27, 2023ACF Photo Gallery Field: Unauthorized modification of dataCVE-2023-3957 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or above, to update the user metas arbitrarily. The meta value can only be a string.
Product
ACF Photo Gallery Field
Affected
up to 1.9
What to do
Affects up to 1.9. Update ACF Photo Gallery Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions.CVE-2023-25473 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions.
Affected
up to 3.5
What to do
Affects up to 3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin <= 1.4.9 versions.CVE-2023-23646 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin <= 1.4.9 versions.
Fixed in
1.5.0
What to do
Update the plugin to 1.5.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2023Gallery Metabox: Unauthorized access of dataCVE-2023-2562 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to obtain a list of images attached to a post.
Product
Gallery Metabox
Affected
up to 1.5
What to do
Affects up to 1.5. Update Gallery Metabox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023Gallery Metabox: Unauthorized modification of dataCVE-2023-2561 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to modify galleries attached to posts and pages with this plugin.
Product
Gallery Metabox
Affected
up to 1.5
What to do
Affects up to 1.5. Update Gallery Metabox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions.CVE-2023-34185 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in John Brien WordPress NextGen GalleryView plugin <= 0.5.5 versions.
Affected
up to 0.5.5
What to do
Affects up to 0.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in GalleryPlugins Video Contest WordPress plugin <= 3.2 versions.CVE-2022-45823 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in GalleryPlugins Video Contest WordPress plugin <= 3.2 versions.
Affected
up to 3.2
What to do
Affects up to 3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 1, 2023WordPress Photo Gallery – Image Gallery: Cross-Site Request ForgeryCVE-2021-4384 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Photo Gallery – Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the load_images_thumbnail() and edit_gallery() functions. This makes it possible for unauthenticated attackers to edit galleries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WordPress Photo Gallery – Image Gallery
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update WordPress Photo Gallery – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 12, 2023Photo Gallery by Ays: Does not escape some parameters before outputting it back in attributesCVE-2023-2568 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Photo Gallery by Ays
Fixed in
5.1.7
What to do
Update Photo Gallery by Ays to 5.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 9, 2023Photo Gallery Slideshow & Masonry Tiled Gallery: Reflected Cross-Site ScriptingCVE-2023-2402 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-41658 appears to be a duplicate of this issue.
Product
Photo Gallery Slideshow & Masonry Tiled Gallery
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Photo Gallery Slideshow & Masonry Tiled Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 7, 2023The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data.CVE-2021-46889 · WordPress plugins & themes · reported by MITREMedium 6.1
The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.
Product
10Web Photo Gallery
Affected
up to 1.5.69
What to do
Affects up to 1.5.69. Update 10Web Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jun 6, 2023Gallery Images Ape: Arbitrary Plugin DeactivationCVE-2019-25149 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated attackers with any capability level to deactivate any plugin on the site, including plugins necessary to site functionality or security.
Product
Gallery Images Ape
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Gallery Images Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 1, 2023A vulnerability was found in Video Playlist and Gallery Plugin up to 1.136 on WordPress.CVE-2015-10109 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in Video Playlist and Gallery Plugin up to 1.136 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality of the file wp-media-cincopa.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.137 is able to address this issue. The name of the patch is ee28e91f4d5404905204c43b7b84a8ffecad932e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230264.
Product
Video Playlist and Gallery
Affected
up to 1.136
What to do
Affects up to 1.136. Update Video Playlist and Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.CVE-2022-45372 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 28, 2023A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress.CVE-2014-125101 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.9 is able to address this issue. The identifier of the patch is 58ed88243e17df766036f4857041edaf358076d3. It is recommended to upgrade the affected component. The identifier VDB-230085 was assigned to this vulnerability.
Product
Portfolio Gallery
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
May 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions.CVE-2023-23705 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions.
Fixed in
4.4.9
What to do
Update the plugin to 4.4.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions.CVE-2023-24414 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions.
Affected
up to 3.2.11
What to do
Affects up to 3.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions.CVE-2022-47134 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions.
Affected
up to 1.5
What to do
Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2023Video Gallery: Reflected Cross-Site ScriptingCVE-2023-2708 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32597 may be a duplicate of this.
Product
Video Gallery
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
Apr 17, 2023The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading CVE-2023-1473 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Fixed in
3.29.1
What to do
Update the plugin to 3.29.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege usersCVE-2023-1427 · WordPress plugins & themes · reported by WPScanMedium 4.9
- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.
Fixed in
1.8.15
What to do
Update the plugin to 1.8.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023Gallery by BestWebSoft: Does not properly escape values used in SQL queriesCVE-2023-0765 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable.
Product
Gallery by BestWebSoft
Fixed in
4.7.0
What to do
Update Gallery by BestWebSoft to 4.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023Gallery by BestWebSoft: Does not perform proper sanitization of gallery informationCVE-2023-0764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription vulnerability. The attacker must have at least the privileges of the Author role.
Product
Gallery by BestWebSoft
Fixed in
4.7.0
What to do
Update Gallery by BestWebSoft to 4.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 9, 2023A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress.CVE-2014-125096 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file class.options.php of the component Options Page. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.13 is able to address this issue. The identifier of the patch is fdf1f9e5a1ec738900f962e69c6fa4ec6055ed8d. It is recommended to upgrade the affected component. The identifier VDB-225349 was assigned to this vulnerability.
Fixed in
1.5.13
What to do
Update the plugin to 1.5.13 or newer.
Full record and what to do →NVD record github.com vuldb.com
Mar 27, 2023Gallery Blocks with Lightbox: Has an AJAX endpoint that can be accessed by any authenticated usersCVE-2023-0441 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.
Product
Gallery Blocks with Lightbox
Fixed in
3.0.8
What to do
Update Gallery Blocks with Lightbox to 3.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 22, 2023The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpCVE-2023-28666 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.
Affected
up to 2.1.4.1
What to do
Affects up to 2.1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 20, 2023Responsive Clients Logo Gallery Plugin for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0175 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive Clients Logo Gallery Plugin for
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Responsive Clients Logo Gallery Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy chCVE-2022-45804 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy change, included plugin deactivate & activate.
Fixed in
3.2.11
What to do
Update the plugin to 3.2.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.CVE-2022-38468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.
Affected
up to 3.28
What to do
Affects up to 3.28. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 13, 2023uTubeVideo Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0151 · WordPress plugins & themes · reported by WPScanMedium 5.4
The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
uTubeVideo Gallery
Fixed in
2.0.8
What to do
Update uTubeVideo Gallery to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Responsive Gallery Grid: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0060 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive Gallery Grid
Fixed in
2.3.9
What to do
Update Responsive Gallery Grid to 2.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Youtube Channel Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4783 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Youtube Channel Gallery
Affected
up to 2.4
What to do
Affects up to 2.4. Update Youtube Channel Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Lightbox Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4682 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Lightbox Gallery
Fixed in
0.9.5
What to do
Update Lightbox Gallery to 0.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Gallery Factory Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Gallery Factory Lite
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Gallery Factory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023Justified Gallery: Does not validate and escape one of its shortcode attributesCVE-2022-4651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
Justified Gallery
Fixed in
1.7.1
What to do
Update Justified Gallery to 1.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Carousel, Slider, Gallery by WP Carousel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4482 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Carousel, Slider, Gallery by WP Carousel
Fixed in
2.5.3
What to do
Update Carousel, Slider, Gallery by WP Carousel to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023User Post Gallery: Does not limit what callback functions can be called by usersCVE-2022-4060 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.
Product
User Post Gallery
Affected
up to 2.19
What to do
Affects up to 2.19. Update User Post Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023WordPress Filter Gallery: Does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the pageCVE-2022-4142 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled.
Product
WordPress Filter Gallery
Fixed in
0.1.6
What to do
Update WordPress Filter Gallery to 0.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.