CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-22797 – WordPress Gallery and Lightbox plugin <= 1.0.14 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2025-22797
13 Jan 2025 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oğulcan Özügenç Gallery and Lightbox allows Stored XSS.This issue affects Gallery and Lightbox: from n/a through 1.0.14. The Gallery and Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to i... • https://patchstack.com/database/wordpress/plugin/gallery-and-lightbox/vulnerability/wordpress-gallery-and-lightbox-plugin-1-0-14-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25060 – WordPress Album and Image Gallery plus Lightbox plugin <= 1.6.2 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2023-25060
02 Feb 2023 — Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Album and Image Gallery plus Lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Album and Image Gallery plus Lightbox: from n/a through 1.6.2. The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on two AJAX actions in versions up to, and including, 1.6.2. This makes it possible for unauthenticated attacke... • https://patchstack.com/database/wordpress/plugin/album-and-image-gallery-plus-lightbox/vulnerability/wordpress-album-and-image-gallery-plus-lightbox-plugin-1-6-2-broken-access-control?_s_id=cve • CWE-862: Missing Authorization •