Wp Responsive Photo Gallery Vulnerabilities

The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjg_get_youtube_info_justified_gallery_callback function. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVSS:

4.3

Affected:

up to 1.0.15

Fixed in:

1.0.16

Disclosed:

Jan 3, 2025

CVE-2024-12237 on NVD →

[en] The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjg_get_youtube_info_justified_gallery_callback function. This makes it possible for authenticated attackers, with Subscriber-level access and a...

Affected:

up to 1.0.16

Fixed in:

1.0.16

Disclosed:

Jan 3, 2025

CVE-2024-12237 on NVD →

[en] The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

Affected:

up to 1.0.4

Fixed in:

1.0.4

Disclosed:

Oct 19, 2024

CVE-2019-25218 on NVD →

The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVSS:

4.9

Affected:

up to 1.0.3

Fixed in:

1.0.4

Disclosed:

Oct 18, 2024

CVE-2019-25218 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Photo Gallery Slideshow & Masonry Tiled Gallery plugin <= 1.0.13 versions.

Affected:

up to 1.0.14

Fixed in:

1.0.14

Disclosed:

Sep 29, 2023

CVE-2023-41658 on NVD →

[en] The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Affected:

up to 1.0.14

Fixed in:

1.0.14

Disclosed:

Jun 9, 2023

CVE-2023-2402 on NVD →

The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbit...

CVSS:

6.1

Affected:

up to 1.0.13

Fixed in:

1.0.14

Disclosed:

Apr 28, 2023

CVE-2023-2402 on NVD →