Updated 14 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,510 results · page 20 of 31

Aug 20, 2015Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary wCVE-2015-6528 · Other software · Coppermine-gallery · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username, (2) admin_password, (3) admin_email, (4) dbserver, (5) dbname, (6) dbuser, (7) dbpass, (8) table_prefix, or (9) impath parameter.
Product
Coppermine Photo Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 18, 2015Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploCVE-2015-5681 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 18, 2015Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands CVE-2015-5599 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
Product
Powerplay Gallery
Affected
3.3 to 3.3
What to do
Affects 3.3 to 3.3. Update Powerplay Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 10, 2015Coppermine Photo Gallery before 1.5.36 allows remote attackers to enumerate directories via a full path in the folder parameter to minibrowser.php.CVE-2015-3923 · Other software · Coppermine-gallery · reported by MITREMedium 5
Coppermine Photo Gallery before 1.5.36 allows remote attackers to enumerate directories via a full path in the folder parameter to minibrowser.php.
Product
Coppermine Photo Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.coppermine-gallery.net packetstormsecurity.com
Jun 10, 2015Multiple directory traversal vulnerabilities in func.php in Magnifica Webscripts Anima Gallery 2.6 allow remote attackers to include and execute arbitrary localCVE-2015-4415 · Other software · Magnifica Webscripts · reported by MITREMedium 5
Multiple directory traversal vulnerabilities in func.php in Magnifica Webscripts Anima Gallery 2.6 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) theme or (2) lang cookie parameter to AnimaGallery/.
Product
Anima Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityfocus.com
May 28, 2015Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to CVE-2015-4133 · WordPress plugins & themes · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.
Product
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery
Fixed in
3.1.4
What to do
Update Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery to 3.1.4 or newer.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
May 27, 2015Open redirect vulnerability in mode.php in Coppermine Photo Gallery before 1.5.36 allows remote attackers to redirect users to arbitrary web sites and conduct pCVE-2015-3922 · Other software · Coppermine-gallery · reported by MITREMedium 5.8
Open redirect vulnerability in mode.php in Coppermine Photo Gallery before 1.5.36 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter.
Product
Coppermine Photo Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.coppermine-gallery.net packetstormsecurity.com
May 27, 2015Cross-site scripting (XSS) vulnerability in contact.php in Coppermine Photo Gallery before 1.5.36 allows remote authenticated users to inject arbitrary web scriCVE-2015-3921 · Other software · Coppermine-gallery · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in contact.php in Coppermine Photo Gallery before 1.5.36 allows remote authenticated users to inject arbitrary web script or HTML via the referer parameter.
Product
Coppermine Photo Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.coppermine-gallery.net packetstormsecurity.com
Apr 24, 2015Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the sCVE-2012-2932 · Other software · Tinywebgallery · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the selitems[] parameter in a (1) copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/index.php.
Product
Tinywebgallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org securityfocus.com
Apr 24, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrCVE-2012-2930 · Other software · Tinywebgallery · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers.php via the user parameter to admin/index.php.
Product
Tinywebgallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org tinywebgallery.com
Mar 12, 2015Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to inject arbitrary web script or HTML via tCVE-2015-2275 · Other software · Wotlab · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to inject arbitrary web script or HTML via the parameters[data][7][title] parameter in a saveImageData action to index.php/AJAXProxy.
Product
Community Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Feb 24, 2015SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows remote atCVE-2015-2065 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php.
Product
SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery)
Fixed in
2.8
What to do
Update SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) to 2.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Feb 2, 2015SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the CVE-2015-1393 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php.
Product
SQL injection vulnerability in the Photo Gallery
Fixed in
1.2.11
What to do
Update SQL injection vulnerability in the Photo Gallery to 1.2.11 or newer.
Full record and what to do →NVD record securityfocus.com plugins.trac.wordpress.org
Jan 16, 2015SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameterCVE-2015-1055 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.
Product
Photo Gallery
Affected
1.2.7 to 1.2.7
What to do
Affects 1.2.7 to 1.2.7. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org securityfocus.com
Jan 13, 2015photocrati-gallery/ecomm-sizes.php in the Photocrati theme for: Cross-site scripting (XSS)CVE-2014-100016 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in photocrati-gallery/ecomm-sizes.php in the Photocrati theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the prod_id parameter.
Product
photocrati-gallery/ecomm-sizes.php in the Photocrati theme for
What to do
Update photocrati-gallery/ecomm-sizes.php in the Photocrati theme for to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Jan 2, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authenticCVE-2014-9441 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) ll__opt[image2_url] or (3) ll__opt[image3_url] parameter in a ll_save_settings action to wp-admin/admin-ajax.php.
Product
Lightbox Photo Gallery
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Lightbox Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Dec 31, 2014Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows remote attackers to hijCVE-2014-9392 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the pictoBrowserFlickrUser parameter in the options-page.php page to wp-admin/options-general.php.
Product
PictoBrowser (pictobrowser-gallery)
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update PictoBrowser (pictobrowser-gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Nov 26, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before 2014-07-23, for WorCVE-2014-9098 · WordPress plugins & themes · reported by MITRELow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before 2014-07-23, for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the videoadssearchQuery parameter to (1) videoads/videoads.php, (2) video/video.php, or (3) playlist/playlist.php.
Product
Apptha WordPress Video Gallery (contus-video-gallery)
Fixed in
2014-07-23
What to do
Update Apptha WordPress Video Gallery (contus-video-gallery) to 2014-07-23 or newer.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 26, 2014Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07-23, for WCVE-2014-9097 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07-23, for WordPress allow (1) remote attackers to execute arbitrary SQL commands via the vid parameter in a myextract action to wp-admin/admin-ajax.php or (2) remote authenticated users to execute arbitrary SQL commands via the playlistId parameter in the newplaylist page or (3) videoId parameter in a newvideo page to wp-admin/admin.php.
Product
Apptha WordPress Video Gallery (contus-video-gallery)
Fixed in
2014-07-23
What to do
Update Apptha WordPress Video Gallery (contus-video-gallery) to 2014-07-23 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Nov 26, 2014Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remCVE-2014-9094 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record seclists.org websecurity.com.ua
Oct 21, 2014SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commandsCVE-2014-8375 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a gb_ajax_get_group action to wp-admin/admin-ajax.php.
Product
GB Gallery Slideshow
Affected
1.5 to 1.5
What to do
Affects 1.5 to 1.5. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com homelab.it
Oct 10, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbCVE-2014-6315 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) callback, (2) dir, or (3) extensions parameter in an addImages action to wp-admin/admin-ajax.php.
Product
Web-Dorado Photo Gallery
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update Web-Dorado Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Oct 3, 2014The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 alCVE-2014-6289 · Other software · Daniel Lienert · reported by MITREHigh 7.5
The Ajax dispatcher for Extbase in the Yet Another Gallery (yag) extension before 3.0.1 and Tools for Extbase development (pt_extbase) extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors.
Product
YET Another Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org typo3.org
Oct 2, 2014The Car Wallpapers HD (aka com.arab4x4.gallery.app) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-midCVE-2014-6857 · Other software · Arabia2000 · reported by cret@cert.orgMedium 5.4
The Car Wallpapers HD (aka com.arab4x4.gallery.app) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
CAR Wallpapers HD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org kb.cert.org
Oct 1, 2014Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers CVE-2011-4624 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
Product
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery)
Fixed in
1.57
What to do
Update Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) to 1.57 or newer.
Full record and what to do →NVD record archives.neohapsis.com plugins.trac.wordpress.org
Sep 22, 2014SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authentiCVE-2014-7153 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the editgallery function in admin/gallery_func.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php.
Product
Huge-IT Image Gallery
Affected
1.0.1 to 1.0.1
What to do
Affects 1.0.1 to 1.0.1. Update Huge-IT Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 11, 2014Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitraCVE-2014-5460 · WordPress plugins & themes · reported by MITREMedium 6.5
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in wp-content/uploads/slideshow-gallery/.
Product
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery
Fixed in
1.4.7
What to do
Update Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery to 1.4.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com secunia.com
Aug 12, 2014SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter iCVE-2014-5201 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a go_view_object action to wp-admin/admin-ajax.php.
Product
Gallery Objects
Affected
0.4 to 0.4
What to do
Affects 0.4 to 0.4. Update Gallery Objects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com homelab.it
Aug 6, 2014SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrarCVE-2014-5186 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogallery_videos page to wp-admin/admin.php.
Product
All Video Gallery (all-video-gallery)
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update All Video Gallery (all-video-gallery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 6, 2014Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack vectors.CVE-2012-6653 · WordPress plugins & themes · reported by MITREHigh 7.5
Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack vectors.
Product
Unspecified vulnerability in the All Video Gallery (all-video-gallery)
Fixed in
1.2.0
What to do
Update Unspecified vulnerability in the All Video Gallery (all-video-gallery) to 1.2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2014Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! CVE-2014-4960 · Websites & servers · Joomlaboat · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.
Product
COM Youtubegallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in fpg_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote attackers to inject arCVE-2014-4529 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in fpg_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.
Product
Flash Photo Gallery
Affected
up to 0.7
What to do
Affects up to 0.7. Update Flash Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jun 4, 2014Multiple cross-site scripting (XSS) vulnerabilities in the (1) Gallery and (2) core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remoCVE-2014-3833 · Other software · Owncloud · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Gallery and (2) core components in ownCloud Server before 5.016 and 6.0.x before 6.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print_unescaped function.
Product
Owncloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record owncloud.org owncloud.org
May 30, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitraCVE-2014-3923 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the logoLink parameter to (1) preview.swf, (2) preview_skin_rouge.swf, (3) preview_allchars.swf, or (4) preview_skin_overlay.swf in deploy/.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record seclists.org websecurity.com.ua
May 14, 2014Multiple cross-site scripting (XSS) vulnerabilities in Gallery 3 before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) movie tiCVE-2013-2087 · Other software · Galleryproject · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Gallery 3 before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) movie title to modules/gallery/controllers/movies.php or (2) key variable to modules/gallery/views/error_admin.html.php.
Product
Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record galleryproject.org osvdb.org
May 8, 2014Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated uCVE-2014-3123 · WordPress plugins & themes · reported by MITRELow 2.1
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.
Product
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery
Fixed in
1.19.18
What to do
Update Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery to 1.19.18 or newer.
Full record and what to do →NVD record secunia.com securityfocus.com
May 6, 2014The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \'CVE-2014-2558 · WordPress plugins & themes · reported by MITREMedium 6.5
The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.
Product
File Gallery
Fixed in
1.7.9.2
What to do
Update File Gallery to 1.7.9.2 or newer.
Full record and what to do →NVD record seclists.org wordpress.org
Apr 25, 2014Cross-site scripting (XSS) vulnerability in includes/flvthumbnail.php in the Youtube Gallery (com_youtubegallery) component 3.4.0 for Joomla! allows remote attaCVE-2013-5956 · Websites & servers · Joomlaboat · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in includes/flvthumbnail.php in the Youtube Gallery (com_youtubegallery) component 3.4.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the videofile parameter.
Product
COM Youtubegallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Apr 11, 2014Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2014-2333 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information.
Product
Cross-site scripting (XSS) vulnerability in the Lazyest Gallery
Fixed in
1.1.21
What to do
Update Cross-site scripting (XSS) vulnerability in the Lazyest Gallery to 1.1.21 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 5, 2014Apptha WordPress Video Gallery 2.0, 1.6, and earlier for: SQL injectionCVE-2013-3478 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comHigh 7.5
SQL injection vulnerability in Apptha WordPress Video Gallery 2.0, 1.6, and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the playid parameter to index.php.
Product
Apptha WordPress Video Gallery 2.0, 1.6, and earlier for
What to do
Update Apptha WordPress Video Gallery 2.0, 1.6, and earlier for to the newest version.
Full record and what to do →NVD record secunia.com securityfocus.com
Oct 9, 2013modules/gallery/helpers/data_rest.php in Gallery 3 before 3.0.9 allows remote attackers to bypass intended access restrictions and obtain sensitive information CVE-2013-2241 · Other software · Menalto · reported by Red HatMedium 5
modules/gallery/helpers/data_rest.php in Gallery 3 before 3.0.9 allows remote attackers to bypass intended access restrictions and obtain sensitive information (image files) via the "full" string in the size parameter.
Product
Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record galleryproject.org sourceforge.net
Oct 9, 2013lib/flowplayer.swf.php in Gallery 3 before 3.0.9 does not properly remove query fragments, which allows remote attackers to have an unspecified impact via a repCVE-2013-2240 · Other software · Menalto · reported by Red HatHigh 7.5
lib/flowplayer.swf.php in Gallery 3 before 3.0.9 does not properly remove query fragments, which allows remote attackers to have an unspecified impact via a replay attack, a different vulnerability than CVE-2013-2138.
Product
Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record galleryproject.org sourceforge.net
Oct 9, 2013The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do not properly remove query parameters and fragments, which allows remote attackers toCVE-2013-2138 · Other software · Menalto · reported by Red HatHigh 7.5
The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do not properly remove query parameters and fragments, which allows remote attackers to have an unspecified impact via a replay attack.
Product
Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record galleryproject.org sourceforge.net
Sep 30, 2013frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for: Unrestricted file uploadCVE-2013-5962 · WordPress plugins & themes · reported by MITREMedium 5.1
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.
Product
frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for
Fixed in
3.3.4
What to do
Update frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for to 3.3.4 or newer.
Full record and what to do →NVD record archives.neohapsis.com codecanyon.net
Jul 16, 2013Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to injCVE-2013-4117 · WordPress plugins & themes · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
Product
Category Grid View Gallery
What to do
Update Category Grid View Gallery to the newest version.
Full record and what to do →NVD record exploit.iedb.ir openwall.com
Jun 1, 2013Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrCVE-2013-3261 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action.
Product
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery
Fixed in
2.72
What to do
Update Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery to 2.72 or newer.
Full record and what to do →NVD record secunia.com wordpress.org
Mar 27, 2013Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Simple Corporate theme before 7.x-1.4 for Drupal allows remote authenticated users with tCVE-2013-1787 · Other software · Devsaran · reported by Red HatLow 2.1
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Simple Corporate theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Product
Corporate
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Mar 27, 2013Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the adminiCVE-2013-1786 · Other software · Devsaran · reported by Red HatLow 2.1
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Product
Company
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Mar 27, 2013Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users withCVE-2013-1785 · Other software · Devsaran · reported by Red HatLow 2.1
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Product
Responsive
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Mar 27, 2013Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Clean Theme before 7.x-1.3 for Drupal allows remote authenticated users with the administCVE-2013-1784 · Other software · Devsaran · reported by Red HatLow 2.1
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Clean Theme before 7.x-1.3 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Product
Clean Theme
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.