CVE-2022-1946
published 2022-07-04CVE-2022-1946: The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to…
PriorityP434medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
1.35%
67.9th percentile
The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | >= 5.16.0 < 6.0.7 | 6.0.7 |
| wpdevart | gallery | < 2.0.0 | 2.0.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat5.5LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
bpf: prevent decl_tag from being referenced in func_proto
osv·2025-12-30
CVE-2022-50862 bpf: prevent decl_tag from being referenced in func_proto
bpf: prevent decl_tag from being referenced in func_proto
In the Linux kernel, the following vulnerability has been resolved:
bpf: prevent decl_tag from being referenced in func_proto
Syzkaller was able to hit the following issue:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3609 at kernel/bpf/btf.c:1946
btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946
Modules linked in:
CPU: 0 PID: 3609 Comm: syz-executor361 Not tainted
6.0.0-syzkaller-02734-g0326074ff465 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 09/22/2022
RIP: 0010:btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946
Code: ef e8 7f 8e e4 ff 41 83 ff 0b 77 28 f6 44 24 10 18 75 3f e8 6d 91
e4 ff 44 89 fe bf 0e 00 00 00 e8 20 8e e4 ff e8 5b 91 e4 ff 0b 45
31 f6 e9 98 02 00 00 41 83 f
GHSA
GHSA-rjrj-j2x7-8hj2: The Gallery WordPress plugin before 2
ghsa_unreviewed·2022-07-05
CVE-2022-1946 [MEDIUM] CWE-79 GHSA-rjrj-j2x7-8hj2: The Gallery WordPress plugin before 2
The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
No detection rules found.
Nuclei
WordPress Gallery <2.0.0 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2022-1946 [MEDIUM] WordPress Gallery <2.0.0 - Cross-Site Scripting
WordPress Gallery alert(document.domain)'
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'wpdevar_gall_img_url_h[alert(document.domain)]'
- type: word
part: header
words:
- text/html
- type: status
status:
- 200
# digest: 4a0a00473045022034471d19f5de8372a2f2fff38de73820371c98cd306840bb906009299b181308022100ed57896f11ff63d0b5d3fab2b859ad35b2e95c410ac2d19377d5d6d468168698:922c64590222798bb761d5b6d8e72950
2022-07-04
Published