CVE-2022-1394

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Photo Gallery by 10Web – Mobile-Friendly Image Gallery	>= 1.6.4, < 1.6.4

References

https://wpscan.com/vulnerability/f7a0df37-3204-4926-84ec-2204a2f22de3Exploit, Third Party Advisory
https://wpscan.com/vulnerability/f7a0df37-3204-4926-84ec-2204a2f22de3Exploit, Third Party Advisory

Timeline

Published: Jun 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-13954.8The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users CVE-2022-13964.8The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, lead CVE-2022-13978.8API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.CVE-2022-13986.5The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via UR CVE-2022-13999.1An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMD CVE-2022-14009.8Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Ap CVE-2022-14017.5Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unaut CVE-2022-14027.1ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-b CVE-2022-14037.8ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-b CVE-2022-14047.1Delta Electronics CNCSoft (All versions prior to 1.01.32) does not properly sanitize input while processing a specific project file, allowin CVE-2022-14057.8CNCSoft: All versions prior to 1.01.32 does not properly sanitize input while processing a specific project file, allowing a possible stack-CVE-2022-14066.5Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14