plugin
6 known security issues reported for the Gallery From Files WordPress plugin. Most recent disclosed Jun 14, 2021.
Running Gallery From Files on your site? Check whether your installed version is affected.
Scan your site free[en] This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, t...
The Gallery From Files plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.60 via improperly implemented allowed extension checks. This allows unauthenticated attackers to upload malicious files to the server which can be used to obtain remote code exectution.
This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the at...
Unauthenticated Remote Code Execution (RCE) vulnerability discovered by WPScanTeam in WordPress Gallery from files plugin (versions <= 1.60).
The Gallery From Files plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.60 via improperly implemented allowed extension checks. This allows unauthenticated attackers to upload malicious files to the server which can be used to obtain remote code exectution.
The upload feature of the plugin does not properly check for the allowed extensions, allowing them to be set in the request and attempting to remove the dangerous ones (such as .php and .js), but forgetting about .php4, .html etc. As a result, unauthenticated users could upload arbitrary .php4 files on the web server a...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free