Vulnerabilities

TI-2021-07183 CVE-2021-24903 · GHSA-p9r5-6jx9-h5wp

GRAND FlaGallery <= 6.1.2 - Admin+ Stored Cross-Site Scripting

LOW 23

The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privilege users to perform Cross-Site scripting attacks even when the unfiltered_html…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-02-28 No fix listed CWE-79

TI-2014-06968 CVE-2014-8491 · GHSA-628c-9prp-wxqw

The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain…

LOW 28

The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagallery-skins/banner_widget_default/gallery.php or (2) flash-album-gallery/skins/banne…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01949 Published 2017-10-18 No fix listed CWE-200

TI-2011-03990 CVE-2011-4624 · GHSA-hg7c-gq55-4mpw

Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin…

LOW 30

Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.07062 Published 2014-10-01 No fix listed CWE-79

Vulnerabilities

Filters

GRAND FlaGallery <= 6.1.2 - Admin+ Stored Cross-Site Scripting

The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain…

Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin…