Photo Gallery By Supsystic
Monthly
Cross-site request forgery (CSRF) in the Supsystic Photo Gallery WordPress plugin through version 1.21.0 allows remote, unauthenticated attackers to make a logged-in administrator perform unintended state-changing actions within the plugin, such as modifying gallery settings or content, by tricking them into visiting a malicious page. Exploitation requires the victim to be authenticated and socially engineered into interacting with the attacker's page (UI:R), but the attacker needs no credentials (PR:N), and the impact is limited to low integrity and availability. No public exploit code has been identified, and no vendor patch is available at time of analysis.
Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data.
Cross-site request forgery (CSRF) in the Supsystic Photo Gallery WordPress plugin through version 1.21.0 allows remote, unauthenticated attackers to make a logged-in administrator perform unintended state-changing actions within the plugin, such as modifying gallery settings or content, by tricking them into visiting a malicious page. Exploitation requires the victim to be authenticated and socially engineered into interacting with the attacker's page (UI:R), but the attacker needs no credentials (PR:N), and the impact is limited to low integrity and availability. No public exploit code has been identified, and no vendor patch is available at time of analysis.
Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data.