Vulnerabilities

TI-2024-10157 CVE-2024-10958 · GHSA-6422-rq87-298q

WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay

MEDIUM 41

The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 .

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.01644 Published 2024-11-10 No fix listed CWE-94

TI-2024-24920 CVE-2024-37416 · GHSA-p688-8h8g-h467

WordPress WP Photo Album Plus plugin <= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00332 Published 2024-07-22 No fix listed CWE-79

TI-2024-03766 CVE-2024-4037

WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution

LOW 33

The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00478 Published 2024-05-24 No fix listed CWE-94

TI-2023-27216 CVE-2023-49812 · GHSA-3vhq-cj93-8r2v

WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR)

MEDIUM 40

Authorization Bypass Through User-Controlled Key vulnerability in J.N.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00533 Published 2023-12-19 No fix listed CWE-639

TI-2023-27217 CVE-2023-49813 · GHSA-hq64-qw75-h6q8

WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00393 Published 2023-12-14 No fix listed CWE-79

TI-2021-07393 CVE-2021-25115 · GHSA-9f55-856w-xqjx

WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)

LOW 30

The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00683 Published 2022-02-14 Fixed in 8.0.10 CWE-79