10Web Photo Gallery vulnerabilities

CVE-2024-5968 [MEDIUM] CWE-79 CVE-2024-5968: The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape som The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVE-2024-8670 [MEDIUM] CWE-79 CVE-2024-8670: The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVE-2024-35628 [MEDIUM] CWE-862 CVE-2024-35628: Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.25.

CVE-2022-1394 [MEDIUM] CWE-79 CVE-2022-1394: The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed

CVE-2024-2296 [MEDIUM] CWE-79 CVE-2024-2296: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Sto The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.8.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrar

CVE-2024-44043 [MEDIUM] CWE-79 CVE-2024-44043: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.27.

CVE-2023-6924 [MEDIUM] CWE-79 CVE-2023-6924: The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wid The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary we

CVE-2024-9878 [MEDIUM] CWE-79 CVE-2024-9878: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Sto The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to in

CVE-2024-13124 [LOW] CWE-79 CVE-2024-13124: The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).