Extension WordPress
Vulnérabilités Slideshow Gallery LITE
Cette page rassemble les failles publiées pour Slideshow Gallery LITE, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Slideshow Gallery LITE
19 fiches
Slideshow Gallery LITE <= 1.8.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute
The Slideshow Gallery LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alwaysauto' shortcode attribute in all versions up to, and including, 1.8.5. This is due to insufficient input sanitization and output escaping on user-supplied…
*-1.8.5
1.8.6
17/06/2026
Slideshow Gallery <= 1.8.3 – Authenticated (Administrator+) Stored Cross-Site Scripting
The Slideshow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and…
*-1.8.3
1.8.4
30/09/2024
Slideshow Gallery LITE <= 1.8.1 – Authenticated (Contributor+) SQL Injection
The Slideshow Gallery LITE plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient…
*-1.8.1
1.8.2
11/06/2024
Slideshow Gallery <= 1.8 – Unauthenticated Sensitive Information Exposure
The Slideshow Gallery LITE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
*-1.8
1.8.1
07/04/2024
Slideshow Gallery <= 1.7.8 – Cross-Site Request Forgery
The Slideshow Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.8. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers…
*-1.7.8
1.7.9
07/04/2024
Slideshow Gallery <= 1.7.8 – Authenticated (Contributor+) SQL Injection
The Slideshow Gallery plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This…
*-1.7.8
1.7.9
07/04/2024
Slideshow Gallery LITE <= 1.7.6 – Authenticated(Admin+) SQL Injection
The Slideshow Gallery LITE plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in versions up to, and including, 1.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…
*-1.7.6
1.7.7
15/03/2023
Slideshow Gallery LITE <= 1.7.6 – Cross-Site Request Forgery via admin_slides
The Slideshow Gallery LITE plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the admin_slides function. This makes it possible for…
*-1.7.6
1.7.7
15/03/2023
Slideshow Gallery LITE <= 1.7.6 – Cross-Site Request Forgery via admin_galleries
The Slideshow Gallery LITE plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the admin_galleries function. This makes it possible for…
*-1.7.6
1.7.7
15/03/2023
Slideshow Gallery < 1.7.4 – Cross-Site Scripting
The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
[*, 1.7.4)
1.7.4
25/10/2021
Slideshow Gallery <= 1.6.8 – Cross-Site Scripting
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter.
*-1.6.8
1.6.9
04/10/2018
Slideshow Gallery <= 1.6.8 – SQL Injection
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
*-1.6.8
1.6.9
04/10/2018
Slideshow Gallery <= 1.6.8 – Cross-Site Scripting
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
*-1.6.8
1.6.9
04/10/2018
Slideshow Gallery <= 1.6.5 – Reflected Cross-Site Scripting
The Tribulant Slideshow Gallery plugin before 1.6.6 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.
*-1.6.5
1.6.6
10/04/2017
Slideshow Gallery <= 1.6.5 – Cross-Site Scripting via method
The Slideshow Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'method' parameter in versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-1.6.5
1.6.6
01/03/2017
Slideshow Gallery <= 1.6 – Cross-Site Scripting
The Slideshow Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘order’ parameter in versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-1.6
1.6.1
21/03/2016
Slideshow Gallery <= 1.5.3.2 – Reflected Cross-Site Scripting
The Slideshow Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Gallerymessage’ parameter in versions up to, and including, 1.5.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
[*, 1.5.3.4)
1.5.3.4
20/08/2015
Slideshow Gallery <= 1.5.3.1 – Cross-Site Request Forgery to Arbitrary File Upload
The Slideshow Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.3.1. This is due to missing nonce validation on the save slideshow functionality. This makes it possible for unauthenticated attackers…
*-1.5.3.1
1.5.3.2
20/08/2015
Slideshow Gallery < 1.4.7 – Arbitrary File Upload
Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execute arbitrary code by uploading a PHP file, then accessing it via a direct request to the file in…
[*, 1.4.7)
1.4.7
29/08/2014
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.