Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Photo Gallery - Remote Code Execution (CVE-2024-37442)
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Photo Gallery Team Photo Gallery by Ays allows Code Injection.This issue affects Photo Gallery by Ays: from n/a before 5.7.1.
PLUGIN
Photo Gallery
CVE-2024-37442
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Broken Access Control (CVE-2024-35628)
Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.25.
PLUGIN
Photo Gallery
CVE-2024-35628
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Path Traversal (CVE-2024-5481)
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the esc_dir function. This makes it possible for authenticated attackers to cut and paste (copy) the contents of arbitrary files on the server, which can contain sensitive information, and to cut (delete) arbitrary directories, including the root WordPress directory. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery edit permissions to lower level…
PLUGIN
Photo Gallery
CVE-2024-5481
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2024-5426)
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure Photo Gallery can be extended to contributors on pro versions of the…
PLUGIN
Photo Gallery
CVE-2024-5426
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - PHP Object Injection (CVE-2024-1896)
The Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.2 via deserialization via shortcode of untrusted input from the 'awl_lg_settings_' attribute. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow…
PLUGIN
Photo Gallery
CVE-2024-1896
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Broken Access Control (CVE-2024-33586)
Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.20.
PLUGIN
Photo Gallery
CVE-2024-33586
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2024-4035)
The Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.7.7.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Photo Gallery
CVE-2024-4035
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2024-32583)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Reflected XSS.This issue affects Photo Gallery by 10Web: from n/a through 1.8.21.
PLUGIN
Photo Gallery
CVE-2024-32583
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2024-2296)
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.8.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE-2024-29833 appears to be a duplicate of this issue.
PLUGIN
Photo Gallery
CVE-2024-2296
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2024-29921)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Photo Gallery by Supsystic gallery-by-supsystic.This issue affects Photo Gallery by Supsystic: from n/a through
PLUGIN
Photo Gallery
CVE-2024-29921
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2024-29833)
The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.
PLUGIN
Photo Gallery
CVE-2024-29833
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2024-29832)
The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.
PLUGIN
Photo Gallery
CVE-2024-29832
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2024-29810)
The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
PLUGIN
Photo Gallery
CVE-2024-29810
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2024-29809)
The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
PLUGIN
Photo Gallery
CVE-2024-29809
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2024-29808)
The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
PLUGIN
Photo Gallery
CVE-2024-29808
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Path Traversal (CVE-2024-0221)
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead to site takeovers if the wp-config.php file of a site can be renamed. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery management permissions to lower level users, which might make this exploitable…
PLUGIN
Photo Gallery
CVE-2024-0221
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2023-6924)
The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. It can also be exploited with a contributor-level permission with a page builder plugin.
PLUGIN
Photo Gallery
CVE-2023-6924
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Request Forgery (CSRF) (CVE-2023-39917)
Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin
PLUGIN
Photo Gallery
CVE-2023-39917
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2023-32107)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin
PLUGIN
Photo Gallery
CVE-2023-32107
Risk Score
Threat Entry
Updated 2026-06-17
Photo Gallery - Cross-Site Scripting (XSS) (CVE-2023-2568)
The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Photo Gallery
CVE-2023-2568
Risk Score