PG
Product
Photo Gallery
49
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 5Medium 36Low 1
Watch
Add Photo Gallery to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0613 | 6.1 | Mar 31 | Photo Gallery < 1.8.34 - Unauthenticated Stored XSS Affected: before 1.8.34 |
| CVE-2024-32583 | 6.1 | Apr 18 | WordPress Photo Gallery by 10Web plugin <= 1.8.21 - Reflected Cross Site Scripting (XSS) vulnerability Affected: before 1.8.22 |
| CVE-2024-29832 | 6.1 | Mar 26 | WordPress Photo Gallery Plugin <= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current_url Affected: before 1.8.22 |
| CVE-2021-46889 | 6.1 | Jun 7 | The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data Affected: through 1.5.69 |
| CVE-2021-31693 | 6.1 | Nov 29 | The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data Affected: through 1.5.68 |
| CVE-2022-1282 | 6.1 | May 2 | The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the… Affected: before 1.6.3 |
| CVE-2021-25041 | 6.1 | Dec 6 | The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET… Affected: before 1.5.68 |
| CVE-2021-24362 | 6.1 | Aug 16 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious… Affected: before 1.5.75 |
| CVE-2021-24291 | 6.1 | May 14 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag,… Affected: before 1.5.69 |
| CVE-2019-16118 | 6.1 | Sep 8 | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php Affected: before 1.5.35 |
| CVE-2019-16117 | 6.1 | Sep 8 | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php Affected: before 1.5.35 |
| CVE-2024-5426 | 5.4 | Jun 7 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG Affected: before 1.8.24 |
| CVE-2024-29833 | 5.4 | Mar 26 | WordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandler Affected: before 1.8.22 |
| CVE-2024-29810 | 5.4 | Mar 26 | WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg thumb_url Affected: before 1.8.22 |
| CVE-2024-29809 | 5.4 | Mar 26 | WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_url Affected: before 1.8.22 |
| CVE-2024-29808 | 5.4 | Mar 26 | WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_id Affected: before 1.8.22 |
| CVE-2022-4058 | 5.4 | Dec 19 | The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which… Affected: before 1.8.3 |
| CVE-2015-1394 | 5.4 | Feb 8 | Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML… Affected: before 1.2.11 |
| CVE-2019-14797 | 5.4 | Aug 9 | The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS Affected: before 1.5.23 |
| CVE-2015-2324 | 5.4 | Feb 19 | Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to… Affected: before 1.2.13 |
| CVE-2024-33586 | 5.3 | Apr 29 | WordPress Photo Gallery by 10Web plugin <= 1.8.20 - Broken Access Control vulnerability Affected: before 1.8.21 |
| CVE-2023-1427 | 4.9 | Apr 17 | - The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images… Affected: before 1.8.15 |
| CVE-2021-24363 | 4.9 | Aug 16 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high… Affected: before 1.5.75 |
| CVE-2019-14798 | 4.9 | Aug 9 | The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg… Affected: before 1.5.25 |
| CVE-2024-8670 | 4.8 | May 15 | Photo Gallery by 10Web < 1.8.29 - Admin+ Stored XSS Affected: before 1.8.29 |
| CVE-2024-10704 | 4.8 | Nov 29 | Photo Gallery by 10Web < 1.8.31 - Admin+ Stored XSS Affected: before 1.8.31 |
| CVE-2024-9878 | 4.8 | Nov 5 | Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: before 1.8.31 |
| CVE-2024-5968 | 4.8 | Oct 9 | Photo Gallery by 10Web <= 1.8.27 - Admin+ Stored XSS Affected: before 1.8.28 |
| CVE-2024-44043 | 4.8 | Oct 6 | WordPress Photo Gallery by 10Web plugin <= 1.8.27 - Cross Site Scripting (XSS) vulnerability Affected: before 1.8.28 |
| CVE-2024-2296 | 4.8 | Apr 6 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG Affected: before 1.8.22 |
| CVE-2023-6924 | 4.8 | Jan 11 | Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget Affected: through 1.8.18 |
| CVE-2022-1394 | 4.8 | Jun 8 | The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to… Affected: before 1.6.4 |
| CVE-2021-24310 | 4.8 | Jun 1 | The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one… Affected: before 1.5.67 |
| CVE-2020-9335 | 4.8 | Feb 25 | Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress Affected: before 1.5.46 |
| CVE-2023-33995 | 4.3 | Dec 13 | WordPress Photo Gallery by 10Web plugin <= 1.8.15 - Broken Access Control vulnerability Affected: before 1.8.16 |
| CVE-2024-35628 | 4.3 | Jun 11 | WordPress Photo Gallery by 10Web plugin <= 1.8.25 - Broken Access Control vulnerability Affected: before 1.8.26 |
Showing 36