The Flickr Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.2 via deserialization of untrusted input from the `pager ` parameter.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.00735·Published 2025-10-18·Fixed in 1.5.3CWE-502