CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25473 – WordPress Flickr Justified Gallery Plugin <= 3.5 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-25473
24 May 2023 — Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions. The Flickr Justified Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5. This is due to missing or incorrect nonce validation on the fjgwpp_settings() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action su... • https://patchstack.com/database/vulnerability/flickr-justified-gallery/wordpress-flickr-justified-gallery-plugin-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4651 – Justified Gallery < 1.7.1 - Contributor+ Stored XSS via Shortcode
https://notcve.org/view.php?id=CVE-2022-4651
23 Dec 2022 — The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. The Justified Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 1.7.0 due to insufficient sanitization and escaping on the attribute values passed through the plugins shortcode. This makes it possible for authenticated attackers with co... • https://wpscan.com/vulnerability/d8182075-7472-48c8-8e9d-94b12ab6fcf6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9327 – Flickr Justified Gallery < 3.4.0 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-9327
28 Jul 2015 — The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS. El plugin flickr-justified-gallery anterior a la versión de 3.4.0 para WordPress tiene XSS. The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS via several parameters. • https://wordpress.org/plugins/flickr-justified-gallery/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •