Threat Entry Updated 2025-12-15

CVE-2025-14288 - Video Gallery And Lightbox For Native Gallery Plugin

The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to unauthorized modification of plugin settings in all versions up to, and including, 3.3.0. This is due to the plugin using the `edit_posts` capability check instead of `manage_options` for the `update_option` action type in the `pgc_sgb_action_wizard` AJAX handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify arbitrary plugin settings prefixed with `pgc_sgb_*`.

PLUGIN Video Gallery And Lightbox For Native Gallery

CVE-2025-14288

MEDIUM CVSS 4.3 2025-12-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-22

CVE-2024-10034 - Video Gallery And Lightbox For Native Gallery Plugin

The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery link text parameter in all versions up to, and including, 3.2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Video Gallery And Lightbox For Native Gallery

CVE-2024-10034

MEDIUM CVSS 5.5 2024-11-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2024-5424 - Video Gallery And Lightbox For Native Gallery Plugin

The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Video Gallery And Lightbox For Native Gallery

CVE-2024-5424

MEDIUM CVSS 6.4 2024-06-28

Risk Score

Open Full Technical Breakdown