Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

776 results · page 6 of 16

Aug 15, 2025Assistant for NextGEN Gallery: Arbitrary directory deletionCVE-2025-7641 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to delete arbitrary directories on the server, which can cause a complete loss of availability.
Product
Assistant for NextGEN Gallery
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Assistant for NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 14, 2025JetProductGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery jet-woo-product-gallery allows Stored XSS.This issue affects JetProductGallery: from n/a through <= 2.2.0.2.
Product
JetProductGallery
Affected
up to 2.2.0.2
What to do
Affects up to 2.2.0.2. Update JetProductGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025flexo-social-gallery: Cross-Site Request Forgery (CSRF)CVE-2025-52769 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in flexostudio flexo-social-gallery flexo-social-gallery allows Cross Site Request Forgery.This issue affects flexo-social-gallery: from n/a through <= 1.0006.
Product
flexo-social-gallery
Affected
up to 1.0006
What to do
Affects up to 1.0006. Update flexo-social-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Global Gallery: Missing AuthorizationCVE-2025-52721 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in LCweb Global Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Global Gallery: from n/a through 9.2.3.
Product
Global Gallery
Affected
up to 9.2.3
What to do
Affects up to 9.2.3. Update Global Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 2, 2025Image Gallery: Reflected Cross-Site ScriptingCVE-2025-8400 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Gallery
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Aug 1, 2025The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor TemCVE-2025-6228 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Sina Posts`, `Sina Blog Post` and `Sina Table` widgets in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI pluginCVE-2025-7725 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment feature in all versions up to, and including, 26.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 26.1.0
What to do
Affects up to 26.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 22, 2025The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerabCVE-2025-7644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 18, 2025Block Editor Gallery Slider: Unauthorized modification of dataCVE-2025-6726 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classic_gallery_slider_options() function in all versions up to, and including, 1.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited post meta for arbitrary posts.
Product
Block Editor Gallery Slider
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Block Editor Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 18, 2025Vertical scroll image slideshow gallery: Stored Cross-Site ScriptingCVE-2025-5752 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Vertical scroll image slideshow gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Vertical scroll image slideshow gallery
Affected
up to 11.1
What to do
Affects up to 11.1. Update Vertical scroll image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 16, 2025Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48291 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 26.0.6.
Product
Contest Gallery
Affected
up to 26.0.6
What to do
Affects up to 26.0.6. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Visual Art | Gallery: Deserialization of Untrusted DataCVE-2025-31422 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Visual Art | Gallery WordPress Theme visual-arts allows Object Injection.This issue affects Visual Art | Gallery WordPress Theme: from n/a through <= 2.4.
Product
Visual Art | Gallery
Affected
up to 2.4
What to do
Affects up to 2.4. Update Visual Art | Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Stored Cross-Site ScriptingCVE-2025-6068 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
Affected
up to 2.4.31
What to do
Affects up to 2.4.31. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2025The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI pluginCVE-2025-6716 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'upload[1][title]' parameter in all versions up to, and including, 26.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 26.0.8
What to do
Affects up to 26.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 4, 2025FW Gallery: Unrestricted Upload of File with Dangerous TypeCVE-2025-49414 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Using Malicious Files.This issue affects FW Gallery: from n/a through <= 8.0.0.
Product
FW Gallery
Affected
up to 8.0.0
What to do
Affects up to 8.0.0. Update FW Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Pixelating image slideshow gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30979 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Pixelating image slideshow gallery pixelating-image-slideshow-gallery allows SQL Injection.This issue affects Pixelating image slideshow gallery: from n/a through <= 8.0.
Product
Pixelating image slideshow gallery
Affected
up to 8.0
What to do
Affects up to 8.0. Update Pixelating image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025iFrame Images Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30969 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus iFrame Images Gallery wp-iframe-images-gallery allows SQL Injection.This issue affects iFrame Images Gallery: from n/a through <= 9.0.
Product
iFrame Images Gallery
Affected
up to 9.0
What to do
Affects up to 9.0. Update iFrame Images Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Gallery Widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28969 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cybio Gallery Widget gallery-widget allows SQL Injection.This issue affects Gallery Widget: from n/a through <= 1.2.1.
Product
Gallery Widget
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Gallery Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Video Gallery Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27326 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through <= 1.1.0.
Product
Video Gallery Block
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Video Gallery Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 3, 2025Portfolio for Elementor & Image Gallery | PowerFolio: Stored Cross-Site ScriptingCVE-2025-7046 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
Product
Portfolio for Elementor & Image Gallery | PowerFolio
Affected
up to 3.2.0
Fixed in
3.2.0
What to do
Update Portfolio for Elementor & Image Gallery | PowerFolio to 3.2.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2025Gmedia Photo Gallery: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53257 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows PHP Local File Inclusion.This issue affects Gmedia Photo Gallery: from n/a through <= 1.23.0.
Product
Gmedia Photo Gallery
Affected
up to 1.23.0
What to do
Affects up to 1.23.0. Update Gmedia Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025FW Gallery: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49416 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows PHP Local File Inclusion.This issue affects FW Gallery: from n/a through <= 8.0.0.
Product
FW Gallery
Affected
up to 8.0.0
What to do
Affects up to 8.0.0. Update FW Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Responsive Lightbox & Gallery: Use the Swipebox libraryCVE-2025-5093 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive Lightbox & Gallery
Fixed in
2.5.2
What to do
Update Responsive Lightbox & Gallery to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 20253D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery: Stored Cross-Site ScriptingCVE-2025-5289 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes.
Product
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
Affected
up to 1.16.15
What to do
Affects up to 1.16.15. Update 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2025Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: Path Traversal: '.../...//'CVE-2025-49451 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: from n/a through <= 1.0.13.
Product
Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025FW Gallery: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-49415 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Path Traversal.This issue affects FW Gallery: from n/a through <= 8.0.0.
Product
FW Gallery
Affected
up to 8.0.0
What to do
Affects up to 8.0.0. Update FW Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 14, 2025Slider, Gallery, and Carousel by MetaSlider: Stored Cross-Site ScriptingCVE-2025-5337 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ parameter in all versions up to, and including, 3.98.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slider, Gallery, and Carousel by MetaSlider
Affected
up to 3.98.0
What to do
Affects up to 3.98.0. Update Slider, Gallery, and Carousel by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2025Apptha Slider Gallery: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31050 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in appthaplugins Apptha Slider Gallery apptha-slider-gallery allows Path Traversal.This issue affects Apptha Slider Gallery: from n/a through <= 2.5.
Product
Apptha Slider Gallery
Affected
up to 2.5
What to do
Affects up to 2.5. Update Apptha Slider Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025YouTube Simple Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-29011 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer YouTube Simple Gallery youtube-simple-gallery allows Stored XSS.This issue affects YouTube Simple Gallery: from n/a through <= 2.2.0.
Product
YouTube Simple Gallery
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update YouTube Simple Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Paged Gallery: Stored Cross-Site ScriptingCVE-2025-5686 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paged Gallery
Affected
up to 0.7
What to do
Affects up to 0.7. Update Paged Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 15, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-8670 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.29
What to do
Update Photo Gallery by 10Web to 1.8.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Smooth Gallery Replacement: Does not have CSRF check in some placesCVE-2024-8032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Smooth Gallery Replacement
Affected
up to 1.0
What to do
Affects up to 1.0. Update Smooth Gallery Replacement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-4091 · WordPress plugins & themes · reported by WPScanLow 3.5
The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Responsive Gallery Grid
Fixed in
2.3.15
What to do
Update Responsive Gallery Grid to 2.3.15 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Carousel, Slider, Gallery by WP Carousel: Does not sanitise and escape some of its settingsCVE-2024-4002 · WordPress plugins & themes · reported by WPScanLow 3.5
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Carousel, Slider, Gallery by WP Carousel
Fixed in
2.6.9
What to do
Update Carousel, Slider, Gallery by WP Carousel to 2.6.9 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-13384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.24
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-10144 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.22
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Responsive Lightbox & Gallery: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3742 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive Lightbox & Gallery
Fixed in
2.5.1
What to do
Update Responsive Lightbox & Gallery to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com
May 8, 2025Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insCVE-2025-3862 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 26.0.6
What to do
Affects up to 26.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 7, 2025Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47677 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Stored XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.25.
Product
Photo Gallery
Affected
up to 2.7.7.25
What to do
Affects up to 2.7.7.25. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Awesome Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47632 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery awesome-gallery allows Stored XSS.This issue affects Awesome Gallery: from n/a through <= 1.0.
Product
Awesome Gallery
Affected
up to 1.0
What to do
Affects up to 1.0. Update Awesome Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Robo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47521 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Robo Gallery robo-gallery allows Stored XSS.This issue affects Robo Gallery: from n/a through <= 5.0.2.
Product
Robo Gallery
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Meow Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47449 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Stored XSS.This issue affects Meow Gallery: from n/a through <= 5.2.7.
Product
Meow Gallery
Affected
up to 5.2.7
What to do
Affects up to 5.2.7. Update Meow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Awesome Wp Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46476 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Awesome Wp Image Gallery awesome-wp-image-gallery allows Stored XSS.This issue affects Awesome Wp Image Gallery: from n/a through <= 1.0.
Product
Awesome Wp Image Gallery
Affected
up to 1.0
What to do
Affects up to 1.0. Update Awesome Wp Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025GB Gallery Slideshow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32649 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gb-plugins GB Gallery Slideshow gb-gallery-slideshow allows Reflected XSS.This issue affects GB Gallery Slideshow: from n/a through <= 1.3.
Product
GB Gallery Slideshow
Affected
up to 1.3
What to do
Affects up to 1.3. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025T&P Gallery Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32527 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pey22 T&P Gallery Slider tp-gallery-slider allows Stored XSS.This issue affects T&P Gallery Slider: from n/a through <= 1.2.
Product
T&P Gallery Slider
Affected
up to 1.2
What to do
Affects up to 1.2. Update T&P Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025WordPress Photo Gallery – Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27291 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxgallery WordPress Photo Gallery – Image Gallery photo-image-gallery allows Reflected XSS.This issue affects WordPress Photo Gallery – Image Gallery: from n/a through <= 2.0.4.
Product
WordPress Photo Gallery – Image Gallery
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update WordPress Photo Gallery – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025InPost Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-26903 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RealMag777 InPost Gallery inpost-gallery allows Cross Site Request Forgery.This issue affects InPost Gallery: from n/a through <= 2.1.4.3.
Product
InPost Gallery
Affected
up to 2.1.4.3
What to do
Affects up to 2.1.4.3. Update InPost Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Global Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22263 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Global Gallery allows Reflected XSS. This issue affects Global Gallery: from n/a through 8.8.0.
Product
Global Gallery
Affected
up to 8.8.0
What to do
Affects up to 8.8.0. Update Global Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2025-2269 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.34
What to do
Affects up to 1.8.34. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2025Smart Product Gallery Slider: Cross-Site Request Forgery (CSRF)CVE-2025-31392 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shameem Reza Smart Product Gallery Slider smart-product-gallery-slider allows Cross Site Request Forgery.This issue affects Smart Product Gallery Slider: from n/a through <= 1.0.4.
Product
Smart Product Gallery Slider
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Smart Product Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.