Vulnerabilities > Imagely > Nextgen Gallery > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-08-01 | CVE-2024-39627 | Cross-site Scripting vulnerability in Imagely Nextgen Gallery Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Imagely NextGEN Gallery allows Stored XSS.This issue affects NextGEN Gallery: from n/a through 3.59.3. | 4.8 |
| 2024-04-09 | CVE-2024-3097 | Missing Authorization vulnerability in Imagely Nextgen Gallery The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. | 5.3 |
| 2023-10-16 | CVE-2023-3279 | Unspecified vulnerability in Imagely Nextgen Gallery The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks | 4.9 |
| 2023-03-01 | CVE-2022-38468 | Cross-Site Request Forgery (CSRF) vulnerability in Imagely Nextgen Gallery Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration. | 4.3 |
| 2022-07-07 | CVE-2015-1785 | Cross-Site Request Forgery (CSRF) vulnerability in Imagely Nextgen Gallery In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. | 6.5 |
| 2021-05-05 | CVE-2021-24293 | Unspecified vulnerability in Imagely Nextgen Gallery In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript. | 6.1 |
| 2021-02-09 | CVE-2020-35943 | Cross-Site Request Forgery (CSRF) vulnerability in Imagely Nextgen Gallery A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. | 6.5 |
| 2019-11-26 | CVE-2015-9538 | Path Traversal vulnerability in Imagely Nextgen Gallery The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection. | 6.5 |
| 2019-11-26 | CVE-2015-9537 | Cross-site Scripting vulnerability in Imagely Nextgen Gallery The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template. | 5.4 |
| 2018-04-30 | CVE-2018-1000172 | Cross-site Scripting vulnerability in Imagely Nextgen Gallery Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. | 4.8 |