Visual Portfolio Vulnerabilities

The Visual Portfolio, Photo Gallery & Post Grid plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of...

CVSS:

7.5

Affected:

up to 3.5.1

Fixed in:

3.5.2

Disclosed:

Mar 20, 2026

CVE-2026-32537 on NVD →

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 3.3.9

Fixed in:

3.3.10

Disclosed:

Dec 3, 2024

CVE-2024-5020 on NVD →

The Visual Portfolio, Photo Gallery & Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level ac...

CVSS:

6.4

Affected:

up to 3.3.2

Fixed in:

3.3.3

Disclosed:

May 14, 2024

CVE-2024-4363 on NVD →

The Visual Portfolio, Photo Gallery & Post Grid plugin for WordPress is vulnerable to CSS injection via the REST API in versions up to, and including, 2.17.0. This allows unauthenticated users to inject arbitrary CSS into saved layouts.

CVSS:

5.3

Affected:

up to 2.17.1

Fixed in:

2.18.0

Disclosed:

Aug 15, 2022

CVE-2022-2543 on NVD →

The Visual Portfolio, Photo Gallery & Post Grid plugin for WordPress is vulnerable to CSS injection via the REST API in versions up to, and including, 2.18.0. This allows authenticated users with contributor or greater privileges to inject arbitrary CSS into saved layouts.

CVSS:

4.3

Affected:

up to 2.18.0

Fixed in:

2.19.0

Disclosed:

Aug 15, 2022

CVE-2022-2597 on NVD →