rootpwn

medium · CVSS v3 4.2 · EPSS 0.00132

CVE-2026-81653

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image …

Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
4.2
CVSS v4
—
EPSS
0.00132

← All CVEs

Related CVEs

medium

CVE-2026-94032

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

View analysis

medium

CVE-2026-93956

A medium‑severity XSS flaw exists in olivier-ls PHP‑FTS up to 1.1.2. The vulnerability is triggered by manipulating the Query argument to SearchEngine::buildHighlights, allowing remote attackers to inject malicious scripts. It can be exploited via a web request to the affected component.

View analysis

medium

CVE-2026-87840

The Tripzzy WordPress plugin before version 1.5.1 fails to enforce capability checks on booking‑management actions, exposing them to unauthenticated users via a token that any visitor can obtain. This flaw allows attackers to modify booking contents, totals, and notes without authorization. The vulnerability can lead to unauthorized data manipulation on affected WordPress sites.

View analysis

medium

CVE-2026-92410

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.

View analysis