Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: realmag777 Component: Inpost Gallery Clear all filters
TI-2024-10193 CVE-2024-11002 · GHSA-cjjx-vgmp-vf5g

Code injection in realmag777 InPost Gallery

Priority LOW 29

The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all versions up to, and including, 2.1.4.2.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00594 Published 2024-11-26 No fix listed CWE-94
TI-2023-13184 CVE-2023-28666 · GHSA-pg65-5772-9qx6

Cross-site scripting in InPost Gallery WordPress Plugin

Priority MEDIUM 58

The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered b…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00441 Published 2023-03-22 No fix listed CWE-79
TI-2022-03728 CVE-2022-4063 · GHSA-5rmh-7p7v-fmfc

InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE

Priority HIGH 82

The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run cod…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10177 Published 2022-12-19 Fixed in 2.1.4.1 CWE-22