CVE-2022-2597: vulnerability in Visual Portfolio, Photo Gallery & Post Grid
Visual Portfolio < 2.19.0 - Contributor+ CSS Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.5%
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts
Affected products
Unknown · Visual Portfolio, Photo Gallery & Post GridRelated CVEs — Visual Portfolio, Photo Gallery & Post Grid
In the same product, most dangerous first.