Catfolders Document Gallery Pdf Library
Monthly
Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.
Stored XSS in CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 allows any user holding an Author account or higher to inject persistent malicious scripts via an unsanitized block attribute that is directly interpolated as an HTML tag name in gallery rendering output. Any visitor who views a post containing the crafted gallery block will execute the attacker's payload in their browser without additional interaction. No active exploitation has been confirmed in CISA KEV, but a publicly available proof-of-concept exists per WPScan disclosure, reducing the technical barrier for any authenticated attacker.
Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.
Stored XSS in CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 allows any user holding an Author account or higher to inject persistent malicious scripts via an unsanitized block attribute that is directly interpolated as an HTML tag name in gallery rendering output. Any visitor who views a post containing the crafted gallery block will execute the attacker's payload in their browser without additional interaction. No active exploitation has been confirmed in CISA KEV, but a publicly available proof-of-concept exists per WPScan disclosure, reducing the technical barrier for any authenticated attacker.