Picture Gallery Vulnerabilities

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 1.6.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitra...

CVSS:

8.1

Affected:

up to 1.6.5

Fixed in:

1.6.6

Disclosed:

Jul 20, 2026

CVE-2026-57696 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Picture Gallery allows Reflected XSS. This issue affects Picture Gallery: from n/a through 1.6.2.

Affected:

up to 1.6.3

Fix:

No patched version reported

Disclosed:

Mar 26, 2025

CVE-2025-26581 on NVD →

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

6.1

Affected:

up to 1.6.3

Fixed in:

1.6.4

Disclosed:

Mar 12, 2025

CVE-2025-26581 on NVD →

[en] The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

Affected:

up to 1.5.20

Fixed in:

1.5.20

Disclosed:

Jan 22, 2025

CVE-2024-13584 on NVD →

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVSS:

6.4

Affected:

up to 1.5.19

Fixed in:

1.5.20

Disclosed:

Jan 21, 2025

CVE-2024-13584 on NVD →

[en] The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisper_picture_upload_guest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user supplied attri...

Affected:

up to 1.5.23

Fixed in:

1.5.23

Disclosed:

Jan 18, 2025

CVE-2024-12696 on NVD →

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisper_picture_upload_guest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user supplied attributes...

CVSS:

6.4

Affected:

up to 1.5.22

Fixed in:

1.5.23

Disclosed:

Jan 17, 2025

CVE-2024-12696 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VideoWhisper Picture Gallery allows Stored XSS.This issue affects Picture Gallery: from n/a through 1.5.11.

Affected:

up to 1.5.12

Fixed in:

1.5.12

Disclosed:

Jun 4, 2024

CVE-2024-34759 on NVD →

The Picture Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 1.5.11

Fixed in:

1.5.12

Disclosed:

May 14, 2024

CVE-2024-34759 on NVD →

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'p_videowhisper_content_edit' parameter in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated att...

CVSS:

5.5

Affected:

up to 1.4.2

Fixed in:

1.4.3

Disclosed:

Aug 10, 2021

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'p_videowhisper_content_edit' parameter in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated att...

Affected:

up to 1.4.3

Fixed in:

1.4.3

Disclosed:

Aug 10, 2021

Stored Cross-Site Scripting (XSS) vulnerability discovered by Aryan Chehreghani in WordPress Picture Gallery plugin (versions <= 1.4.3).

Affected:

up to 1.4.4

Fixed in:

1.4.4

Disclosed:

Aug 6, 2021

The plugin does not properly sanitize input on a field found in the plugin&#039;s settings page, leading to a stored cross site scripting risk where authenticated users can target other authenticated users.

Affected:

up to 1.4.4

Fixed in:

1.4.4