Responsive Gallery Grid Vulnerabilities

The Responsive Gallery Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.3.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to...

CVSS:

4.4

Affected:

up to 2.3.14

Fixed in:

2.3.15

Disclosed:

Oct 30, 2024

CVE-2024-4091 on NVD →

[en] The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 2.3.11

Fixed in:

2.3.11

Disclosed:

Apr 9, 2024

CVE-2024-1664 on NVD →

The Responsive Gallery Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.3.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to...

CVSS:

4.4

Affected:

up to 2.3.10

Fixed in:

2.3.11

Disclosed:

Mar 19, 2024

CVE-2024-1664 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Jules Colle, BDWM Responsive Gallery Grid plugin <= 2.3.10 versions.

Affected:

up to 2.3.14

Fixed in:

2.3.14

Disclosed:

Oct 6, 2023

CVE-2023-41659 on NVD →

The Responsive Gallery Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.13. This is due to missing nonce validation on the rgg_options_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request gra...

CVSS:

5.4

Affected:

up to 2.3.13

Fixed in:

2.3.14

Disclosed:

Sep 1, 2023

CVE-2023-41659 on NVD →

[en] The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected:

up to 2.3.9

Fixed in:

2.3.9

Disclosed:

Feb 13, 2023

CVE-2023-0060 on NVD →

The Responsive Gallery Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor le...

CVSS:

6.4

Affected:

up to 2.3.8

Fixed in:

2.3.9

Disclosed:

Jan 17, 2023

CVE-2023-0060 on NVD →

Affected:

up to 2.3.15

Fixed in:

2.3.15

CVE-2024-4091 on NVD →