10web Photo_gallery
49 CVEs affecting 10web Photo_gallery. Latest disclosed: 2025-05-15. Critical: 6, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1281 | Critical | 9.8 | 2022-05-02 | The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Inj… |
CVE-2022-0169 | Critical | 9.8 | 2022-03-14 | The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statem… |
CVE-2021-24139 | Critical | 9.8 | 2021-03-18 | Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php… |
CVE-2019-16119 | Critical | 9.8 | 2019-09-08 | SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id param… |
CVE-2019-14313 | Critical | 9.8 | 2019-07-30 | A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a… |
CVE-2024-0221 | Critical | 9.1 | 2024-02-05 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8… |
CVE-2015-9380 | High | 8.8 | 2019-08-30 | The photo-gallery plugin before 1.2.42 for WordPress has CSRF. |
CVE-2014-9312 | High | 8.8 | 2017-08-28 | Unrestricted File Upload vulnerability in Photo Gallery 1.2.5. |
CVE-2017-12977 | High | 7.2 | 2017-08-21 | The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag()… |
CVE-2024-32583 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Reflecte… |
CVE-2024-5481 | Medium | 6.8 | 2024-06-07 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 vi… |
CVE-2024-5426 | Medium | 6.4 | 2024-06-07 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all ver… |
CVE-2025-0613 | Medium | 6.1 | 2025-03-31 | The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unaut… |
CVE-2024-29832 | Medium | 6.1 | 2024-03-26 | The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current… |
CVE-2021-46889 | Medium | 6.1 | 2023-06-07 | The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291… |
CVE-2021-31693 | Medium | 6.1 | 2022-11-29 | The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: othe… |
CVE-2022-1282 | Medium | 6.1 | 2022-05-02 | The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when… |
CVE-2021-25041 | Medium | 6.1 | 2021-12-06 | The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and short… |
CVE-2021-24362 | Medium | 6.1 | 2021-08-16 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not cont… |
CVE-2021-24291 | Medium | 6.1 | 2021-05-14 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the… |