Advisories · Technology
Envira Gallery.
Every CVE that names Envira Gallery among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.7 Low
Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode
- Envira Gallery
- Broken access control
- CVSS 2.7 Low
Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
- Envira Gallery
- Broken access control
- CVSS 2.7 Low
Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field
- Envira Gallery
- Information disclosure
- CVSS 7.2 High
Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard
- Envira Gallery
- Privilege escalation
- CVSS 6.8 Medium
Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions
- Envira Gallery
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID
- Envira Gallery
- Cross-site scripting (XSS)