IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
6.4Mittel

CVE-2024-13584Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

videowhisper Picture Gallery – Frontend Image Uploads, AJAX Photo List Veröffentlicht: (vor 1 Jahr)

Beschreibung

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Schwachstellentyp (CWE): CWE-79

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
videowhisper picture gallery < 1.5.20
videowhisper Picture Gallery – Frontend Image Uploads, AJAX Photo List ≤ 1.5.19

Referenzen und Patches

CPE-Treffer (NVD) (1)
  • cpe:2.3:a:videowhisper:picture_gallery:*:*:*:*:*:wordpress:*:* < 1.5.20

Neue CVEs im selben Produkt — WordPress plugins & themes

7.1Hoch
CVE-2026-124969

Optimole <= 4.2.19 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via 'comment_content'/'comment_agent' Parameter during Attachment Rename

optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the replace_urls_in_value function in all versions up to, and…

9.8Kritisch
CVE-2026-126173

AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field

AutomatorWP AutomatorWP Webhooks

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible …