Vulnerability database

779 results · page 16 of 16

• Dec 31, 2014Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows remote attackers to hijCVE-2014-9392 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the pictoBrowserFlickrUser parameter in the options-page.php page to wp-admin/options-general.php.

  Product

  PictoBrowser (pictobrowser-gallery)

  Affected

  up to 0.3.1

  What to do

  Affects up to 0.3.1. Update PictoBrowser (pictobrowser-gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Nov 26, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before 2014-07-23, for WorCVE-2014-9098 · WordPress plugins & themes · reported by MITRELow 3.5

  Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before 2014-07-23, for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the videoadssearchQuery parameter to (1) videoads/videoads.php, (2) video/video.php, or (3) playlist/playlist.php.

  Product

  Apptha WordPress Video Gallery (contus-video-gallery)

  Fixed in

  2014-07-23

  What to do

  Update Apptha WordPress Video Gallery (contus-video-gallery) to 2014-07-23 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

• Nov 26, 2014Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07-23, for WCVE-2014-9097 · WordPress plugins & themes · reported by MITREHigh 7.5

  Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07-23, for WordPress allow (1) remote attackers to execute arbitrary SQL commands via the vid parameter in a myextract action to wp-admin/admin-ajax.php or (2) remote authenticated users to execute arbitrary SQL commands via the playlistId parameter in the newplaylist page or (3) videoId parameter in a newvideo page to wp-admin/admin.php.

  Product

  Apptha WordPress Video Gallery (contus-video-gallery)

  Fixed in

  2014-07-23

  What to do

  Update Apptha WordPress Video Gallery (contus-video-gallery) to 2014-07-23 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

• Nov 26, 2014Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remCVE-2014-9094 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordseclists.orgwebsecurity.com.ua

• Oct 21, 2014SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commandsCVE-2014-8375 · WordPress plugins & themes · reported by MITREMedium 6.5

  SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a gb_ajax_get_group action to wp-admin/admin-ajax.php.

  Product

  GB Gallery Slideshow

  Affected

  1.5 to 1.5

  What to do

  Affects 1.5 to 1.5. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comhomelab.it

• Oct 10, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbCVE-2014-6315 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) callback, (2) dir, or (3) extensions parameter in an addImages action to wp-admin/admin-ajax.php.

  Product

  Web-Dorado Photo Gallery

  Affected

  up to 1.1.30

  What to do

  Affects up to 1.1.30. Update Web-Dorado Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comsecunia.com

• Oct 1, 2014Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers CVE-2011-4624 · WordPress plugins & themes · reported by Red HatMedium 4.3

  Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

  Product

  Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery)

  Fixed in

  1.57

  What to do

  Update Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) to 1.57 or newer.

  Full record and what to do →NVD recordarchives.neohapsis.complugins.trac.wordpress.org

• Sep 22, 2014SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authentiCVE-2014-7153 · WordPress plugins & themes · reported by MITREMedium 6.5

  SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php.

  Product

  Huge-IT Image Gallery

  Affected

  1.0.1 to 1.0.1

  What to do

  Affects 1.0.1 to 1.0.1. Update Huge-IT Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com

• Sep 11, 2014Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitraCVE-2014-5460 · WordPress plugins & themes · reported by MITREMedium 6.5

  Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.

  Product

  Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery

  Fixed in

  1.4.7

  What to do

  Update Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery to 1.4.7 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comsecunia.com

• Aug 12, 2014SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter iCVE-2014-5201 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a go_view_object action to wp-admin/admin-ajax.php.

  Product

  Gallery Objects

  Affected

  0.4 to 0.4

  What to do

  Affects 0.4 to 0.4. Update Gallery Objects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comhomelab.it

• Aug 6, 2014SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrarCVE-2014-5186 · WordPress plugins & themes · reported by MITREMedium 6.5

  SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogallery_videos page to wp-admin/admin.php.

  Product

  All Video Gallery (all-video-gallery)

  Affected

  1.2 to 1.2

  What to do

  Affects 1.2 to 1.2. Update All Video Gallery (all-video-gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• Aug 6, 2014Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack vectors.CVE-2012-6653 · WordPress plugins & themes · reported by MITREHigh 7.5

  Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack vectors.

  Product

  Unspecified vulnerability in the All Video Gallery (all-video-gallery)

  Fixed in

  1.2.0

  What to do

  Update Unspecified vulnerability in the All Video Gallery (all-video-gallery) to 1.2.0 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Jul 2, 2014Cross-site scripting (XSS) vulnerability in fpg_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote attackers to inject arCVE-2014-4529 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in fpg_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.

  Product

  Flash Photo Gallery

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update Flash Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• May 30, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitraCVE-2014-3923 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the logoLink parameter to (1) preview.swf, (2) preview_skin_rouge.swf, (3) preview_allchars.swf, or (4) preview_skin_overlay.swf in deploy/.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordseclists.orgwebsecurity.com.ua

• May 8, 2014Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated uCVE-2014-3123 · WordPress plugins & themes · reported by MITRELow 2.1

  Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.

  Product

  Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery

  Fixed in

  1.19.18

  What to do

  Update Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery to 1.19.18 or newer.

  Full record and what to do →NVD recordsecunia.comsecurityfocus.com

• May 6, 2014The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \'CVE-2014-2558 · WordPress plugins & themes · reported by MITREMedium 6.5

  The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.

  Product

  File Gallery

  Fixed in

  1.7.9.2

  What to do

  Update File Gallery to 1.7.9.2 or newer.

  Full record and what to do →NVD recordseclists.orgwordpress.org

• Apr 11, 2014Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2014-2333 · WordPress plugins & themes · reported by MITRELow 2.6

  Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information.

  Product

  Cross-site scripting (XSS) vulnerability in the Lazyest Gallery

  Fixed in

  1.1.21

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Lazyest Gallery to 1.1.21 or newer.

  Full record and what to do →NVD recordsecunia.comwordpress.org

• Mar 5, 2014Apptha WordPress Video Gallery 2.0, 1.6, and earlier for: SQL injectionCVE-2013-3478 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comHigh 7.5

  SQL injection vulnerability in Apptha WordPress Video Gallery 2.0, 1.6, and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the playid parameter to index.php.

  Product

  Apptha WordPress Video Gallery 2.0, 1.6, and earlier for

  What to do

  Update Apptha WordPress Video Gallery 2.0, 1.6, and earlier for to the newest version.

  Full record and what to do →NVD recordsecunia.comsecurityfocus.com

• Sep 30, 2013frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for: Unrestricted file uploadCVE-2013-5962 · WordPress plugins & themes · reported by MITREMedium 5.1

  Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.

  Product

  frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for

  Fixed in

  3.3.4

  What to do

  Update frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for to 3.3.4 or newer.

  Full record and what to do →NVD recordarchives.neohapsis.comcodecanyon.net

• Jul 16, 2013Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to injCVE-2013-4117 · WordPress plugins & themes · reported by Red HatMedium 4.3

  Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.

  Product

  Category Grid View Gallery

  What to do

  Update Category Grid View Gallery to the newest version.

  Full record and what to do →NVD recordexploit.iedb.iropenwall.com

• Jun 1, 2013Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrCVE-2013-3261 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3

  Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action.

  Product

  Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery

  Fixed in

  2.72

  What to do

  Update Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery to 2.72 or newer.

  Full record and what to do →NVD recordsecunia.comwordpress.org

• Oct 1, 2012css/gallery-css.php in the Slideshow Gallery2 plugin for: Cross-site scripting (XSS)CVE-2012-5229 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the border parameter.

  Product

  css/gallery-css.php in the Slideshow Gallery2 plugin for

  What to do

  Update css/gallery-css.php in the Slideshow Gallery2 plugin for to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecurityfocus.com

• Jun 15, 2012Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploadinCVE-2012-3575 · WordPress plugins & themes · reported by MITREHigh 10

  Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/rbxslider.

  Product

  RBX Gallery

  What to do

  Update RBX Gallery to the newest version.

  Full record and what to do →NVD recordsecunia.comexploit-db.com

• Oct 7, 2011Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote CVE-2010-4875 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.

  Product

  Vodpod Video Gallery

  What to do

  Update Vodpod Video Gallery to the newest version.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Apr 7, 2010Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitraCVE-2010-1186 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

  Product

  Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery

  Fixed in

  1.5.2

  What to do

  Update Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery to 1.5.2 or newer.

  Full record and what to do →NVD recordsecunia.comwordpress.org

• Sep 8, 2009wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for: Cross-site scripting (XSS)CVE-2008-7175 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.

  Product

  wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for

  Affected

  up to 0.96

  What to do

  Affects up to 0.96. Update wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgsecurityfocus.com

• Dec 30, 2008Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allCVE-2008-5752 · WordPress plugins & themes · reported by MITREMedium 4.3

  Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter. NOTE: some of these details are obtained from third party information.

  Product

  Page Flip Image Gallery

  Affected

  up to 0.2.2

  What to do

  Affects up to 0.2.2. Update Page Flip Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Jan 30, 2008fim_rss.php in the fGallery 2.4.1 plugin for: SQL injectionCVE-2008-0491 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the album parameter.

  Product

  fim_rss.php in the fGallery 2.4.1 plugin for

  Affected

  2.4.1 to 2.4.1

  What to do

  Affects 2.4.1 to 2.4.1. Update fim_rss.php in the fGallery 2.4.1 plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecurityfocus.comvupen.com

• May 1, 2007myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for: PHP remote file inclusionCVE-2007-2426 · WordPress plugins & themes · reported by MITREHigh 7.5

  PHP remote file inclusion vulnerability in myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the myPath parameter.

  Product

  myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for

  Affected

  up to 1.4b4

  What to do

  Affects up to 1.4b4. Update myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.