cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-2744,https://securityvulnerability.io/vulnerability/CVE-2024-2744,NextGEN Gallery Plugin Vulnerable to Cross-Site Scripting Attacks,"The NextGEN Gallery  WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed",Wordpress,Nextgen Gallery,,,0.0004299999854993075,false,,false,false,true,true,false,false,2024-05-17T06:00:02.141Z,0
CVE-2024-3097,https://securityvulnerability.io/vulnerability/CVE-2024-3097,Unauthorized Data Access Vulnerability in NextGEN Gallery Plugin for WordPress,"The NextGEN Gallery plugin for WordPress is susceptible to unauthorized access, allowing attackers to bypass security measures due to a missing capability check in the get_item function. This vulnerability enables unauthenticated users to extract sensitive image metadata, including EXIF data, from any images uploaded via the plugin. The issue affects versions up to and including 3.59, posing a significant risk to site owners who need to protect their media data. Immediate action is recommended for users of the affected versions.",Wordpress,WordPress Gallery Plugin – Nextgen Gallery,5.3,MEDIUM,0.061469998210668564,false,,false,false,false,,false,false,2024-04-09T18:58:58.660Z,0
CVE-2023-48328,https://securityvulnerability.io/vulnerability/CVE-2023-48328,WordPress NextGEN Gallery Plugin <= 3.37 is vulnerable to Cross Site Request Forgery (CSRF),"A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Imagely WordPress Gallery Plugin – NextGEN Gallery. This vulnerability allows attackers to execute unauthorized actions on behalf of authenticated users without their consent. This issue affects all versions up to 3.37, posing significant risks to website security and integrity. Website administrators are urged to implement protective measures and update to the latest version to mitigate potential threats.",Wordpress,WordPress Gallery Plugin – NextGEN Gallery,8.8,HIGH,0.0008699999889358878,false,,false,false,false,,false,false,2023-11-30T16:15:00.000Z,0
CVE-2022-38468,https://securityvulnerability.io/vulnerability/CVE-2022-38468,WordPress NextGEN Gallery Plugin <= 3.28 is vulnerable to Cross Site Request Forgery (CSRF),Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.,Wordpress,WordPress Gallery Plugin – Nextgen Gallery,4.3,MEDIUM,0.0005300000193528831,false,,false,false,false,,false,false,2023-03-01T13:02:01.753Z,0
CVE-2015-1784,https://securityvulnerability.io/vulnerability/CVE-2015-1784,File Upload and CSRF Vulnerabilities in NextGen Gallery Plugin for WordPress,"The NextGen Gallery plugin for WordPress, prior to version 2.0.77.3, contains critical vulnerabilities that compromise web application security. The flaws are primarily due to improper validation of user-uploaded files and inadequate security measures against unwanted HTTP requests. These vulnerabilities could be exploited by attackers to potentially gain unauthorized access to the application and its data. Users are advised to restrict the plugin version and apply necessary updates to avoid these risks.",Wordpress,Nextgen-gallery,8.8,HIGH,0.001769999973475933,false,,false,false,false,,false,false,2022-07-07T12:34:24.000Z,0
CVE-2015-1785,https://securityvulnerability.io/vulnerability/CVE-2015-1785,File Upload and Request Validation Vulnerabilities in NextGEN Gallery Plugin for WordPress,"The NextGEN Gallery Plugin for WordPress, prior to version 2.0.77.3, contains significant vulnerabilities that could allow attackers to take full control of the application. These issues stem from inadequate validation of user-uploaded files coupled with a lack of security measures that guard against malicious HTTP requests. Exploiting these vulnerabilities could lead to unauthorized access and potentially compromise the entire web application.",Wordpress,Nextgen-gallery,6.5,MEDIUM,0.000699999975040555,false,,false,false,false,,false,false,2022-07-07T12:34:19.000Z,0
CVE-2022-1971,https://securityvulnerability.io/vulnerability/CVE-2022-1971,NextCellent Gallery <= 1.9.35 - Admin+ Stored XSS,"The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)",Wordpress,Nextcellent Gallery – Nextgen Legacy,4.8,MEDIUM,0.000539999979082495,false,,false,false,false,,false,false,2022-06-27T08:59:02.000Z,0
CVE-2021-24293,https://securityvulnerability.io/vulnerability/CVE-2021-24293,NextGEN Gallery Pro < 3.1.11 - Reflected Cross-Site Scripting (XSS),"In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.",Wordpress,Nextgen Gallery Pro,6.1,MEDIUM,0.001230000052601099,false,,false,false,false,,false,false,2021-05-05T18:28:48.000Z,0
CVE-2020-35943,https://securityvulnerability.io/vulnerability/CVE-2020-35943,,A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.),Wordpress,Nextgen Gallery,6.5,MEDIUM,0.0012000000569969416,false,,false,false,false,,false,false,2021-02-09T17:49:27.000Z,0
CVE-2020-35942,https://securityvulnerability.io/vulnerability/CVE-2020-35942,,"A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)",Wordpress,Nextgen Gallery,8.8,HIGH,0.008679999969899654,false,,false,false,false,,false,false,2021-02-09T17:49:23.000Z,0
CVE-2013-3684,https://securityvulnerability.io/vulnerability/CVE-2013-3684,,NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload,Wordpress,Nextgen Gallery,9.8,CRITICAL,0.015850000083446503,false,,false,false,false,,false,false,2020-02-11T17:48:40.000Z,0
CVE-2013-0291,https://securityvulnerability.io/vulnerability/CVE-2013-0291,,NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability,Wordpress,Nextgen Gallery Plugin,7.5,HIGH,0.3820199966430664,false,,false,false,false,,false,false,2020-01-30T13:00:16.000Z,0
CVE-2015-9537,https://securityvulnerability.io/vulnerability/CVE-2015-9537,,"The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template.",Wordpress,Nextgen Gallery,5.4,MEDIUM,0.001069999998435378,false,,false,false,false,,false,false,2019-11-26T14:59:27.000Z,0
CVE-2015-9538,https://securityvulnerability.io/vulnerability/CVE-2015-9538,,The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.,Wordpress,Nextgen Gallery,6.5,MEDIUM,0.002460000105202198,false,,false,false,false,,false,false,2019-11-26T14:59:17.000Z,0
CVE-2019-14314,https://securityvulnerability.io/vulnerability/CVE-2019-14314,,A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.,Wordpress,Nextgen Gallery,9.8,CRITICAL,0.0035200000274926424,false,,false,false,true,true,false,false,2019-08-27T15:58:40.000Z,0
CVE-2016-10889,https://securityvulnerability.io/vulnerability/CVE-2016-10889,,The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.,Wordpress,Nextgen Gallery,9.8,CRITICAL,0.0016400000313296914,false,,false,false,false,,false,false,2019-08-14T14:50:58.000Z,0
CVE-2016-6565,https://securityvulnerability.io/vulnerability/CVE-2016-6565,The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious file,"The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).",Wordpress,Nextgen Gallery Plugin,7.5,HIGH,0.0042500002309679985,false,,false,false,false,,false,false,2018-07-13T20:00:00.000Z,0
CVE-2018-7586,https://securityvulnerability.io/vulnerability/CVE-2018-7586,,"In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.",Wordpress,Nextgen Gallery,7.5,HIGH,0.00171999994199723,false,,false,false,false,,false,false,2018-03-01T21:00:00.000Z,0
CVE-2015-9229,https://securityvulnerability.io/vulnerability/CVE-2015-9229,,"In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter.",Wordpress,Nextgen Gallery,4.8,MEDIUM,0.0010100000072270632,false,,false,false,false,,false,false,2017-09-12T22:00:00.000Z,0
CVE-2015-9228,https://securityvulnerability.io/vulnerability/CVE-2015-9228,,"In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.",Wordpress,Nextgen Gallery,8.8,HIGH,0.005830000154674053,false,,false,false,false,,false,false,2017-09-12T08:00:00.000Z,0
CVE-2010-1186,https://securityvulnerability.io/vulnerability/CVE-2010-1186,,Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.,Wordpress,Nextgen Gallery,,,0.010599999688565731,false,,false,false,false,,false,false,2010-04-07T15:00:00.000Z,0
CVE-2008-7175,https://securityvulnerability.io/vulnerability/CVE-2008-7175,,Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.,Wordpress,Nextgen Gallery,,,0.0013200000394135714,false,,false,false,false,,false,false,2009-09-08T10:00:00.000Z,0