Vulnerabilities

TI-2024-05682 CVE-2024-6132 · GHSA-98j7-qj5p-vpgv

Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

MEDIUM 43

The Pexels: Free Stock Photos plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'pexels_fsp_images_options_validate' function in all versions up to, and including, 1.…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01382 Published 2024-06-19 No fix listed CWE-434

TI-2024-17015 CVE-2024-25915 · GHSA-9xp2-5x23-fhj5

WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF)

LOW 38

Server-Side Request Forgery (SSRF) vulnerability in Raaj Trambadia Pexels: Free Stock Photos.This issue affects Pexels: Free Stock Photos: from n/a through 1.2.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00303 Published 2024-02-23 No fix listed CWE-918

Vulnerabilities

Filters

Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF)