CVE-2025-12377mediumCWE-862

CVE-2025-12377: falha de média gravidade em smub Envira Gallery – Image Photo Gallery…

Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.3%
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-level access and above, to perform multiple actions, such as removing images from arbitrary galleries. The vulnerability was partially patched in version 1.12.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
smub · Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
CVEs relacionadas — smub Envira Gallery – Image Photo Gallery…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-5020MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryEPSS 0.4%CVE-2023-6742MEDIUMEnvira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_imagesEPSS 0.4%CVE-2026-5361MEDIUMEnvira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' ParameterEPSS 0.4%CVE-2026-3423MEDIUMEnvira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery DescriptionEPSS 0.3%CVE-2026-1236MEDIUMEnvira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST APIEPSS 0.3%CVE-2025-11448MEDIUMGallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery ConversionEPSS 0.2%