WordPress CVEs

Description

The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Affected WordPress components

• album-and-image-gallery-plus-lightbox Plugin · album-and-image-gallery-plus-lightbox
  Confirmed match Homeless
  Up to and including 2.0
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• essentialplugin Album and Image Gallery Plus Lightbox — Up to and including 2.0
• wponlinesupport album_and_image_gallery_plus_lightbox — Up to and including 2.0
• essentialplugin album_and_image_gallery_plus_lightbox — Before 2.1

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album-slider.php#L207 Product
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album.php#L185 Product
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3097986%40album-and-image-gallery-plus-lightbox&new=3097986%40album-and-image-gallery-plus-lightbox&sfp_email=&sfph_mail=
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/4822f1c7-3f83-416c-8957-17e4b53d7e69?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record