WordPress Plugin Vulnerabilities

WP Social Feed Gallery < 2.4.8 - CSRF & Missing Authorisation Checks

Description

The lack of CSRF and Authorisations checks in some AJAX methods, such as qligg_dismiss_notice and qligg_form_item_delete could allow attacker to perform unauthorised actions via actions when logged in as a low privilege user, or via CSRF attacks.

Affects Plugins

Plugin icon
insta-gallery
Fixed in 2.4.8

References

CVE
CVE-2019-15779

Miscellaneous

Verified
No
WPVDB ID
1543bb1f-8a5c-4865-98c5-25c20c736c3c

Timeline

Publicly Published
2019-08-12 (about 6 years ago)
Added
2019-08-29 (about 6 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2020-06-28
Title
Nexos - Real Estate < 1.8 - Unauthenticated Reflected XSS & SQL Injection
Published
2020-03-13
Title
Fruitful < 3.8.2 - Authenticated Stored XSS & Theme Options Deletion
Published
2014-08-01
Title
image-gallery-with-slideshow <= 1.5 - Arbitrary File Upload / SQL Injection
Published
2014-04-24
Title
iMember360 < 3.9.001 - Multiple Issues
Published
2015-05-10
Title
XCloner - Backup and Restore 3.1.2 - XSS & Command Execution