Show filters
4 Total Results
Displaying 1-4 of 4
Sort by:
Attacker Value
Unknown
CVE-2022-0873
Disclosure Date: May 16, 2022 (last updated February 23, 2025)
The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed
0
Attacker Value
Unknown
CVE-2021-24903
Disclosure Date: February 28, 2022 (last updated February 23, 2025)
The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privilege users to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
0
Attacker Value
Unknown
CVE-2014-8491
Disclosure Date: October 18, 2017 (last updated November 26, 2024)
The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagallery-skins/banner_widget_default/gallery.php or (2) flash-album-gallery/skins/banner_widget_default/gallery.php.
0
Attacker Value
Unknown
CVE-2011-4624
Disclosure Date: October 01, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
0
