Vulnerabilities

TI-2022-03660 CVE-2022-3991 · GHSA-86xj-57mh-7xc3

Photospace Gallery <= 2.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting

LOW 30

The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanit…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00695 Published 2022-11-29 No fix listed CWE-79

TI-2022-17839 CVE-2022-38135 · GHSA-cvjg-9hcx-pvx4

WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability

LOW 26

Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00667 Published 2022-09-12 No fix listed CWE-264

Vulnerabilities

Filters

Photospace Gallery <= 2.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting

WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability