5.4Medium

CVE-2022-45804WordPress Robo Gallery Plugin <= 3.2.9 is vulnerable to Cross Site Request Forgery (CSRF)

RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery Published: 2023-03-01 16:19 (3 years ago)

Description

Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy change, included plugin deactivate & activate.

Weakness (CWE): CWE-352

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
robogallery	robo gallery	< 3.2.11
RoboSoft	Photo Gallery, Images, Slider in Rbs Image Gallery	≤ 3.2.9

References and patches

https://patchstack.com/database/vulnerability/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image… vdb-entryThird Party Advisory

CPE matches (NVD) (1)

cpe:2.3:a:robogallery:robo_gallery:*:*:*:*:*:wordpress:*:* < 3.2.11

CVSS score

5.4Medium

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

All scores (3)

cna	CVSS 3.1	5.4Medium
audit@patchstack.com	CVSS 3.1	4.3Medium
nvd	CVSS 3.1	5.4Medium

EPSS (chance of exploitation in 30 days)

0.23%

higher than 14% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2022-11-23
Published2023-03-01 16:19
Reached IP-DB2026-10-24 23:37
Last updated2026-11-10 15:10

Assigned by (CNA): Patchstack
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

8.8High

CVE-2026-124251 3 hours ago

WordPress WPIDE – File Manager & Code Editor plugin <= 3.6.4 - Cross Site Request Forgery (CSRF) vulnerability

XplodedThemes WPIDE – File Manager & Code Editor

Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.This issue affects WPIDE – File Manager & Code Editor: from n/a through 3.6.4.

5.3Medium

CVE-2026-106007 10 hours ago

FraudLabs Pro SMS Verification <= 1.12.1 - Unauthenticated Unrestricted SMS Sending via wp_sms_action_send

FraudLabs Pro SMS Verification

The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting th…

5.3Medium

CVE-2026-106025 10 hours ago

Cargo Shipping Location for WooCommerce 4.0.0 - 5.7.1 - Unauthenticated Order Status Manipulation

Cargo Shipping Location for WooCommerce

The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users …

7.2High

CVE-2026-84938 12 hours ago

Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook

themefusion Avada (Fusion) Builder

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient …

7.5High

CVE-2026-100386 12 hours ago

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser

themefic Ultra Addons for Contact Form 7

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function. This makes it possible for unauthenticated attackers to read the contents …

7.2High

CVE-2026-93427 12 hours ago

ARMember Premium <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Registration Custom Field

armember ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.…