Vulnerabilities

TI-2023-03676 CVE-2023-3957 · GHSA-h24q-rf77-p6mc

ACF Photo Gallery Field <= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Update

LOW 21

The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00503 Published 2023-07-27 No fix listed CWE-285

TI-2021-07189 CVE-2021-24909 · GHSA-v6cq-mg6h-wjfc

ACF Photo Gallery Field < 1.7.5 - Reflected Cross-Site Scripting

LOW 29

The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflec…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-01-17 Fixed in 1.7.5 CWE-79

Vulnerabilities

Filters

ACF Photo Gallery Field <= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Update

ACF Photo Gallery Field < 1.7.5 - Reflected Cross-Site Scripting