CVE-2015-7527

HIGH 7.5 CVSS 2.0

Published: December 17, 2015
Last modified: June 17, 2026
NVD status: Modified
Reported by: secalert@redhat.com
Weakness: CWE-20
CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of preview image" and possibly other input fields in the "Video Gallery Settings" page.

Affected products and versions

n/a n/a — Versions not specified
cool_video_gallery_project cool_video_gallery — Version 1.9

References

packetstormsecurity.com http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html Exploit
www.openwall.com http://www.openwall.com/lists/oss-security/2015/12/02/9 Exploit
www.securityfocus.com http://www.securityfocus.com/archive/1/537051/100/0/threaded
www.vapidlabs.com http://www.vapidlabs.com/advisory.php?v=158 Exploit
wordpress.org https://wordpress.org/support/topic/command-injection-vulnerability-in-v19 Exploit
wpvulndb.com https://wpvulndb.com/vulnerabilities/8348
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References