Updated 18 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

776 results · page 8 of 16

Jan 24, 2025FooGallery Captions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23889 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten FooGallery Captions foogallery-captions allows Reflected XSS.This issue affects FooGallery Captions: from n/a through <= 1.0.2.
Product
FooGallery Captions
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update FooGallery Captions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 24, 2025Simple Gallery with Filter: Stored Cross-Site ScriptingCVE-2024-13583 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Gallery with Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'c2tw_sgwf' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Gallery with Filter
Affected
up to 2.0
What to do
Affects up to 2.0. Update Simple Gallery with Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2025Good Old Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23959 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linus Lundahl Good Old Gallery good-old-gallery allows Reflected XSS.This issue affects Good Old Gallery: from n/a through <= 2.1.2.
Product
Good Old Gallery
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Good Old Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025WP Load Gallery: Unrestricted Upload of File with Dangerous TypeCVE-2025-23942 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery allows Upload a Web Shell to a Web Server.This issue affects WP Load Gallery: from n/a through <= 2.1.6.
Product
WP Load Gallery
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update WP Load Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Image Gallery Box by CRUDLab: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-23938 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CRUDLab Image Gallery Box by CRUDLab image-gallery-box-by-crudlab allows PHP Local File Inclusion.This issue affects Image Gallery Box by CRUDLab: from n/a through <= 1.0.3.
Product
Image Gallery Box by CRUDLab
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Image Gallery Box by CRUDLab to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Rio Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sabareesha Rio Photo Gallery rio-photo-gallery allows Reflected XSS.This issue affects Rio Photo Gallery: from n/a through <= 0.1.
Product
Rio Photo Gallery
Affected
up to 0.1
What to do
Affects up to 0.1. Update Rio Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Picture Gallery – Frontend Image Uploads, AJAX Photo List: Stored Cross-Site ScriptingCVE-2024-13584 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Picture Gallery – Frontend Image Uploads, AJAX Photo List
Affected
up to 1.5.19
What to do
Affects up to 1.5.19. Update Picture Gallery – Frontend Image Uploads, AJAX Photo List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 18, 2025Picture Gallery – Frontend Image Uploads, AJAX Photo List: Stored Cross-Site ScriptingCVE-2024-12696 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisper_picture_upload_guest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Picture Gallery – Frontend Image Uploads, AJAX Photo List
Affected
up to 1.5.22
What to do
Affects up to 1.5.22. Update Picture Gallery – Frontend Image Uploads, AJAX Photo List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jan 16, 2025Gallery: Hybrid – Advanced Visual Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23951 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DIVENGINE Gallery: Hybrid – Advanced Visual Gallery hybrid-gallery allows Stored XSS.This issue affects Gallery: Hybrid – Advanced Visual Gallery: from n/a through <= 1.4.0.2.
Product
Gallery: Hybrid – Advanced Visual Gallery
Affected
up to 1.4.0.2
What to do
Affects up to 1.4.0.2. Update Gallery: Hybrid – Advanced Visual Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025WordPress Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-23842 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nilesh Shiragave WordPress Gallery Plugin wordpress-gallery-plugin allows Cross Site Request Forgery.This issue affects WordPress Gallery Plugin: from n/a through <= 1.4.
Product
WordPress Gallery
Affected
up to 1.4
What to do
Affects up to 1.4. Update WordPress Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025AI Responsive Gallery Album: Missing AuthorizationCVE-2025-23785 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in August Infotech AI Responsive Gallery Album ai-responsive-gallery-album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Responsive Gallery Album: from n/a through <= 1.4.
Product
AI Responsive Gallery Album
Affected
up to 1.4
What to do
Affects up to 1.4. Update AI Responsive Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Gallery and Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22797 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oğulcan Özügenç Gallery and Lightbox gallery-and-lightbox allows Stored XSS.This issue affects Gallery and Lightbox: from n/a through <= 1.0.14.
Product
Gallery and Lightbox
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Gallery and Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Photo Gallery – Image Gallery by Ape: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22317 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gallery Ape Photo Gallery – Image Gallery by Ape gallery-images-ape allows Reflected XSS.This issue affects Photo Gallery – Image Gallery by Ape: from n/a through <= 2.2.8.
Product
Photo Gallery – Image Gallery by Ape
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Photo Gallery – Image Gallery by Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Image Gallery – Responsive Photo Gallery: Reflected Cross-Site ScriptingCVE-2024-12403 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Gallery – Responsive Photo Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'awsmgallery' parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Image Gallery – Responsive Photo Gallery
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Image Gallery – Responsive Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 8, 2025Modula Image Gallery: Arbitrary file uploadsCVE-2024-12853 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Modula Image Gallery
Affected
up to 2.11.10
What to do
Affects up to 2.11.10. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2025ST Gallery WP: Missing AuthorizationCVE-2025-22543 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in beautifultemplates ST Gallery WP st-gallery-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ST Gallery WP: from n/a through <= 1.0.8.
Product
ST Gallery WP
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update ST Gallery WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Justified Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22518 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Justified Image Gallery justified-image-gallery allows Stored XSS.This issue affects Justified Image Gallery: from n/a through <= 1.0.
Product
Justified Image Gallery
Affected
up to 1.0
What to do
Affects up to 1.0. Update Justified Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025BVD Easy Gallery Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22353 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bvads BVD Easy Gallery Manager bvd-easy-gallery-manager allows Reflected XSS.This issue affects BVD Easy Gallery Manager: from n/a through <= 1.0.6.
Product
BVD Easy Gallery Manager
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update BVD Easy Gallery Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its Gallery settingsCVE-2024-10102 · WordPress plugins & themes · reported by WPScanLow 2.7
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.22
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 6, 2025WP Youtube Gallery: Stored Cross-Site ScriptingCVE-2024-12590 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Youtube Gallery
Affected
up to 1.9
What to do
Affects up to 1.9. Update WP Youtube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 3, 2025Photo Gallery Slideshow & Masonry Tiled Gallery: Server-Side Request ForgeryCVE-2024-12237 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjg_get_youtube_info_justified_gallery_callback function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to retrieve limited information from internal services.
Product
Photo Gallery Slideshow & Masonry Tiled Gallery
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Photo Gallery Slideshow & Masonry Tiled Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 2, 2025Gallery Images Ape: Missing AuthorizationCVE-2022-41995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Galleryape Gallery Images Ape allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gallery Images Ape: from n/a through 2.2.8.
Product
Gallery Images Ape
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Gallery Images Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56237 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through <= 24.0.3.
Product
Contest Gallery
Affected
up to 24.0.3
What to do
Affects up to 24.0.3. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025Responsive Image Gallery, Gallery Album: Missing AuthorizationCVE-2023-45631 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
Product
Responsive Image Gallery, Gallery Album
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 2, 2025odPhotogallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56036 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ondrej Donek odPhotogallery od-photogallery-plugin allows Reflected XSS.This issue affects odPhotogallery: from n/a through <= 0.5.3.
Product
odPhotogallery
Affected
up to 0.5.3
What to do
Affects up to 0.5.3. Update odPhotogallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2024Exhibit to WP Gallery: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12096 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Exhibit to WP Gallery WordPress plugin through 0.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Exhibit to WP Gallery
Affected
up to 0.0.2
What to do
Affects up to 0.0.2. Update Exhibit to WP Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 16, 2024Portfolio – Filterable Masonry Portfolio Gallery for Professionals: Stored Cross-Site ScriptingCVE-2024-11900 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'portfolio-pro' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Portfolio – Filterable Masonry Portfolio Gallery for Professionals
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Portfolio – Filterable Masonry Portfolio Gallery for Professionals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2024Nabz Image Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55981 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.
Product
Nabz Image Gallery
Affected
up to 1.00
What to do
Affects up to 1.00. Update Nabz Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2024Video & Photo Gallery for Ultimate Member: Unrestricted Upload of File with Dangerous TypeCVE-2024-54370 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Upload a Web Shell to a Web Server.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.0.
Product
Video & Photo Gallery for Ultimate Member
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Automatic YouTube Gallery: Missing AuthorizationCVE-2023-41866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Team Plugins360 Automatic YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic YouTube Gallery: from n/a through 2.3.3.
Product
Automatic YouTube Gallery
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Automatic YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Justified Gallery: Missing AuthorizationCVE-2023-40213 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mateusz Czardybon Justified Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justified Gallery: from n/a through 1.7.3.
Product
Justified Gallery
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Justified Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Photo Gallery by 10Web: Missing AuthorizationCVE-2023-33995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15.
Product
Photo Gallery by 10Web
Affected
up to 1.8.15
What to do
Affects up to 1.8.15. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Portfolio Gallery – Responsive Image Gallery: Missing AuthorizationCVE-2023-32585 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Total-Soft Portfolio Gallery – Responsive Image Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery – Responsive Image Gallery: from n/a through 1.4.6.
Product
Portfolio Gallery – Responsive Image Gallery
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Portfolio Gallery – Responsive Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Video Gallery – YouTube Gallery: Missing AuthorizationCVE-2023-25988 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Video Gallery by Total-Soft Video Gallery – YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Gallery – YouTube Gallery: from n/a through 1.7.6.
Product
Video Gallery – YouTube Gallery
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Video Gallery – YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Robo Gallery: Missing AuthorizationCVE-2022-45841 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RoboSoft Robo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robo Gallery: from n/a through 3.2.9.
Product
Robo Gallery
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024Video & Photo Gallery for Ultimate Member: Reflected Cross-Site ScriptingCVE-2024-12162 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video & Photo Gallery for Ultimate Member plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Video & Photo Gallery for Ultimate Member
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 10, 2024Best WordPress Gallery Plugin – FooGallery: Directory TraversalCVE-2023-6947 · WordPress plugins & themes · reported by WordfenceHigh 7.7
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive information such as folder structure.
Product
Best WordPress Gallery Plugin – FooGallery
Affected
up to 2.4.26
What to do
Affects up to 2.4.26. Update Best WordPress Gallery Plugin – FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Dec 9, 2024Album and Image Gallery plus Lightbox: Missing AuthorizationCVE-2023-25060 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Album and Image Gallery plus Lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Album and Image Gallery plus Lightbox: from n/a through 1.6.2.
Product
Album and Image Gallery plus Lightbox
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Album and Image Gallery plus Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 7, 2024Gallery: PHP Object InjectionCVE-2024-11501 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input from wd_gallery_$id parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
Gallery
Affected
up to 1.3
What to do
Affects up to 1.3. Update Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024Folder Gallery: Stored Cross-Site ScriptingCVE-2024-11823 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Folder Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'foldergallery' shortcode in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Folder Gallery
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update Folder Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 5, 2024Video Gallery – Best WordPress YouTube Gallery: Stored Cross-Site ScriptingCVE-2024-9769 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Video Gallery – Best WordPress YouTube Gallery
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Video Gallery – Best WordPress YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordfence.com
Dec 5, 2024Video Gallery – Best WordPress YouTube Gallery: Time-based SQL InjectionCVE-2024-10247 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Video Gallery – Best WordPress YouTube Gallery
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Video Gallery – Best WordPress YouTube Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Dec 3, 2024WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout: Stored Cross-Site ScriptingCVE-2024-11453 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_pin_widget' shortcode in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout
Affected
up to 1.8.8
What to do
Affects up to 1.8.8. Update WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 2, 2024AI Responsive Gallery Album: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52467 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech AI Responsive Gallery Album ai-responsive-gallery-album allows Reflected XSS.This issue affects AI Responsive Gallery Album: from n/a through <= 1.4.
Product
AI Responsive Gallery Album
Affected
up to 1.4
What to do
Affects up to 1.4. Update AI Responsive Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 1, 2024Elementor Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53744 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SkyBootstrap Elementor Image Gallery Plugin skyboot-portfolio-gallery allows Stored XSS.This issue affects Elementor Image Gallery Plugin: from n/a through <= 1.0.5.
Product
Elementor Image Gallery
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Elementor Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 30, 2024WordPress Portfolio Builder – Portfolio Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53788 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gallery uber-grid allows Stored XSS.This issue affects WordPress Portfolio Builder – Portfolio Gallery: from n/a through <= 1.1.7.
Product
WordPress Portfolio Builder – Portfolio Gallery
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 29, 2024Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10704 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.31
What to do
Update Photo Gallery by 10Web to 1.8.31 or newer.
Full record and what to do →NVD record wpscan.com
Nov 28, 2024Contest Gallery: Privilege escalationCVE-2024-11103 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Product
Contest Gallery
Affected
up to 24.0.7
What to do
Affects up to 24.0.7. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 26, 2024BNE Gallery Extended: Stored Cross-Site ScriptingCVE-2024-11119 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BNE Gallery Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BNE Gallery Extended
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update BNE Gallery Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 26, 2024The InPost Gallery: Arbitrary shortcode executionCVE-2024-11002 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all versions up to, and including, 2.1.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Product
The InPost Gallery
Affected
up to 2.1.4.2
What to do
Affects up to 2.1.4.2. Update The InPost Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.