CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3991 – Photospace Gallery <= 2.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-3991
14 Nov 2022 — The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Photospace Gallery para WordPress es vulnerable a... • https://plugins.trac.wordpress.org/browser/photospace/trunk/photospace.php#L87 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38135 – WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2022-38135
12 Sep 2022 — Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings. Una vulnerabilidad de Control de Acceso Roto en el plugin Photospace Gallery versiones anteriores a 2.3.5 incluyéndola, de Dean Oakley en WordPress permite a usuarios con rol de suscriptor o superior cambiar la configuración del plugin The Photospace Gallery plugin for WordPress is vulnerable to authorization bypass due to a missing capab... • https://patchstack.com/database/vulnerability/photospace/wordpress-photospace-gallery-plugin-2-3-5-broken-access-control-vulnerability • CWE-264: Permissions, Privileges, and Access Controls CWE-285: Improper Authorization •