Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

169 results · page 2 of 4

Dec 19, 2025Image Photo Gallery Final Tiles Grid: Authorization bypassCVE-2025-14455 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete, modify, or clone galleries created by any user, including administrators.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Local File InclusionCVE-2025-13641 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter. This is due to insufficient path validation that allows absolute paths to be provided. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, bypassing web server restrictions like .htaccess. Successful exploitation could lead to information disclosure, code execution in the WordPress context, and potential remote code execution if combined with arbitrary file upload capabilities.
Product
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Affected
up to 3.59.12
What to do
Affects up to 3.59.12. Update Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 2, 2025Photo Gallery by Ays: Cross-Site Request ForgeryCVE-2025-13685 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing nonce verification on the bulk action functionality in the 'process_bulk_action()' function. This makes it possible for unauthenticated attackers to perform bulk operations (delete, publish, or unpublish galleries) via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
Photo Gallery by Ays
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update Photo Gallery by Ays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 13, 2025Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2025-12377 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-level access and above, to perform multiple actions, such as removing images from arbitrary galleries. The vulnerability was partially patched in version 1.12.0.
Product
Gallery Plugin for WordPress – Envira Photo Gallery
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Gallery Plugin for WordPress – Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record drive.google.com plugins.trac.wordpress.org
Nov 8, 2025Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2025-11448 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries.
Product
Gallery Plugin for WordPress – Envira Photo Gallery
Affected
up to 1.11.0
What to do
Affects up to 1.11.0. Update Gallery Plugin for WordPress – Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 6, 2025Image Gallery block – Create and display photo gallery/photo album.: Missing AuthorizationCVE-2025-49394 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through <= 1.0.7.
Product
Image Gallery block – Create and display photo gallery/photo album.
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Image Gallery block – Create and display photo gallery/photo album. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Photo Gallery by Ays: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57947 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Photo Gallery by Ays gallery-photo-gallery allows DOM-Based XSS.This issue affects Photo Gallery by Ays: from n/a through <= 6.3.8.
Product
Photo Gallery by Ays
Affected
up to 6.3.8
What to do
Affects up to 6.3.8. Update Photo Gallery by Ays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Stored Cross-Site ScriptingCVE-2025-6068 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
Affected
up to 2.4.31
What to do
Affects up to 2.4.31. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2025Gmedia Photo Gallery: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53257 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows PHP Local File Inclusion.This issue affects Gmedia Photo Gallery: from n/a through <= 1.23.0.
Product
Gmedia Photo Gallery
Affected
up to 1.23.0
What to do
Affects up to 1.23.0. Update Gmedia Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: Path Traversal: '.../...//'CVE-2025-49451 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: from n/a through <= 1.0.13.
Product
Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-8670 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.29
What to do
Update Photo Gallery by 10Web to 1.8.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-13384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.24
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2024-10144 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.22
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 7, 2025Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47677 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Stored XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.25.
Product
Photo Gallery
Affected
up to 2.7.7.25
What to do
Affects up to 2.7.7.25. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025WordPress Photo Gallery – Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27291 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxgallery WordPress Photo Gallery – Image Gallery photo-image-gallery allows Reflected XSS.This issue affects WordPress Photo Gallery – Image Gallery: from n/a through <= 2.0.4.
Product
WordPress Photo Gallery – Image Gallery
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update WordPress Photo Gallery – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2025-2269 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.34
What to do
Affects up to 1.8.34. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2025Video & Photo Gallery for Ultimate Member: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32121 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows SQL Injection.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.3.
Product
Video & Photo Gallery for Ultimate Member
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Photo Gallery by 10Web: Does not sanitised and escaped comment added on images by unauthenticated usersCVE-2025-0613 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed
Product
Photo Gallery by 10Web
Fixed in
1.8.34
What to do
Update Photo Gallery by 10Web to 1.8.34 or newer.
Full record and what to do →NVD record wpscan.com
Mar 27, 2025Video & Photo Gallery for Ultimate Member: Server-Side Request Forgery (SSRF)CVE-2025-22672 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Server Side Request Forgery.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.2.
Product
Video & Photo Gallery for Ultimate Member
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13124 · WordPress plugins & themes · reported by WPScanLow 3.5
The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.33
What to do
Update Photo Gallery by 10Web to 1.8.33 or newer.
Full record and what to do →NVD record wpscan.com
Mar 8, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Stored Cross-Site ScriptingCVE-2024-12119 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the default_gallery_title_size parameter in all versions up to, and including, 2.4.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with granted gallery and album creator roles, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
Affected
up to 2.4.29
What to do
Affects up to 2.4.29. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 8, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Insecure Direct Object ReferenceCVE-2024-12114 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogallery_attachment_modal_save AJAX action due to missing validation on a user controlled key (img_id). This makes it possible for authenticated attackers, with granted access and above, to update arbitrary post and page content. This requires the Gallery Creator Role setting to be a value lower than 'Editor' for there to be any real impact.
Product
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
Affected
up to 2.4.29
What to do
Affects up to 2.4.29. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 27, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable.CVE-2025-22624 · WordPress plugins & themes · reported by help@fluidattacks.comMedium 5.1
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/extensions/albums/admin/class-meta boxes.php.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record fluidattacks.com wordpress.org
Feb 27, 2025Image Photo Gallery Final Tiles Grid: Stored Cross-Site ScriptingCVE-2024-6261 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2025Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Image settingsCVE-2024-10545 · WordPress plugins & themes · reported by WPScanLow 3.5
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery, Sliders, Proofing and
Fixed in
3.59.9
What to do
Update Photo Gallery, Sliders, Proofing and to 3.59.9 or newer.
Full record and what to do →NVD record wpscan.com
Feb 24, 2025Photo Gallery ( Responsive ): Cross-Site Request Forgery (CSRF)CVE-2025-27276 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Photo Gallery ( Responsive ) photo-gallery-pearlbells allows Privilege Escalation.This issue affects Photo Gallery ( Responsive ): from n/a through <= 4.0.
Product
Photo Gallery ( Responsive )
Affected
up to 4.0
What to do
Affects up to 4.0. Update Photo Gallery ( Responsive ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 20253D Photo Gallery: Stored Cross-Site ScriptingCVE-2024-13751 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des[]' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
3D Photo Gallery
Affected
up to 1.3
What to do
Affects up to 1.3. Update 3D Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 3, 2025Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24707 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.24.
Product
Photo Gallery
Affected
up to 2.7.7.24
What to do
Affects up to 2.7.7.24. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2025Image Gallery – Responsive Photo Gallery: Missing AuthorizationCVE-2025-24697 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Realwebcare Image Gallery – Responsive Photo Gallery awesome-responsive-photo-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Gallery – Responsive Photo Gallery: from n/a through <= 1.0.5.
Product
Image Gallery – Responsive Photo Gallery
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Image Gallery – Responsive Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Rio Photo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sabareesha Rio Photo Gallery rio-photo-gallery allows Reflected XSS.This issue affects Rio Photo Gallery: from n/a through <= 0.1.
Product
Rio Photo Gallery
Affected
up to 0.1
What to do
Affects up to 0.1. Update Rio Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Photo Gallery – Image Gallery by Ape: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22317 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gallery Ape Photo Gallery – Image Gallery by Ape gallery-images-ape allows Reflected XSS.This issue affects Photo Gallery – Image Gallery by Ape: from n/a through <= 2.2.8.
Product
Photo Gallery – Image Gallery by Ape
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Photo Gallery – Image Gallery by Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Image Gallery – Responsive Photo Gallery: Reflected Cross-Site ScriptingCVE-2024-12403 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Gallery – Responsive Photo Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'awsmgallery' parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Image Gallery – Responsive Photo Gallery
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Image Gallery – Responsive Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its Gallery settingsCVE-2024-10102 · WordPress plugins & themes · reported by WPScanLow 2.7
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.22
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2025Photo Gallery Slideshow & Masonry Tiled Gallery: Server-Side Request ForgeryCVE-2024-12237 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjg_get_youtube_info_justified_gallery_callback function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to retrieve limited information from internal services.
Product
Photo Gallery Slideshow & Masonry Tiled Gallery
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Photo Gallery Slideshow & Masonry Tiled Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 16, 2024Video & Photo Gallery for Ultimate Member: Unrestricted Upload of File with Dangerous TypeCVE-2024-54370 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Upload a Web Shell to a Web Server.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.0.
Product
Video & Photo Gallery for Ultimate Member
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 13, 2024Photo Gallery by 10Web: Missing AuthorizationCVE-2023-33995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15.
Product
Photo Gallery by 10Web
Affected
up to 1.8.15
What to do
Affects up to 1.8.15. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 12, 2024Video & Photo Gallery for Ultimate Member: Reflected Cross-Site ScriptingCVE-2024-12162 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video & Photo Gallery for Ultimate Member plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Video & Photo Gallery for Ultimate Member
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 29, 2024Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10704 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery by 10Web
Fixed in
1.8.31
What to do
Update Photo Gallery by 10Web to 1.8.31 or newer.
Full record and what to do →NVD record wpscan.com
Nov 25, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Images settingsCVE-2024-6393 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery, Sliders, Proofing and
Fixed in
3.59.5
What to do
Update Photo Gallery, Sliders, Proofing and to 3.59.5 or newer.
Full record and what to do →NVD record wpscan.com
Nov 5, 2024Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Stored Cross-Site ScriptingCVE-2024-9878 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.30
What to do
Affects up to 1.8.30. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-43925 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.14.
Product
Envira Photo Gallery
Affected
up to 1.8.14
What to do
Affects up to 1.8.14. Update Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-37095 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.7.3.
Product
Envira Photo Gallery
Affected
up to 1.8.7.3
What to do
Affects up to 1.8.7.3. Update Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 20, 2024Photo Gallery Builder: Missing AuthorizationCVE-2024-49325 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdiscover Photo Gallery Builder photo-gallery-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Photo Gallery Builder: from n/a through <= 3.0.
Product
Photo Gallery Builder
Affected
up to 3.0
What to do
Affects up to 3.0. Update Photo Gallery Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 19, 2024Photo Gallery Slideshow & Masonry Tiled Gallery: SQL InjectionCVE-2019-25218 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Photo Gallery Slideshow & Masonry Tiled Gallery
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Photo Gallery Slideshow & Masonry Tiled Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 9, 2024Photo Gallery by 10Web: Does not properly sanitise and escape some of its Gallery settingsCVE-2024-5968 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery by 10Web
Fixed in
1.8.28
What to do
Update Photo Gallery by 10Web to 1.8.28 or newer.
Full record and what to do →NVD record wpscan.com
Oct 8, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Unauthorized access of dataCVE-2024-8431 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve private post titles.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.21
What to do
Affects up to 3.2.21. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 6, 2024Photo Gallery by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44043 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.27.
Product
Photo Gallery by 10Web
Affected
up to 1.8.27
What to do
Affects up to 1.8.27. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 24, 2024Photo Gallery, Images, Slider in Rbs Image Gallery: Stored Cross-Site ScriptingCVE-2024-3896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the Gallery title field in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Affected
up to 3.2.19
What to do
Affects up to 3.2.19. Update Photo Gallery, Images, Slider in Rbs Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 13, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its settingsCVE-2024-5442 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Photo Gallery, Sliders, Proofing and
Fixed in
3.59.3
What to do
Update Photo Gallery, Sliders, Proofing and to 3.59.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2024Image Photo Gallery Final Tiles Grid: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-3710 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
Product
Image Photo Gallery Final Tiles Grid
Fixed in
3.6.0
What to do
Update Image Photo Gallery Final Tiles Grid to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.