CVE-2022-2190

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownGallery Plugin for WordPress – Envira Photo Gallery>= 1.8.4.7, < 1.8.4.7

References

Timeline

Published
Oct 31, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-219004.6Windows Hyper-V Security Feature Bypass VulnerabilityCVE-2022-219018.0Windows Hyper-V Elevation of Privilege VulnerabilityCVE-2022-219027.8Windows DWM Core Library Elevation of Privilege VulnerabilityCVE-2022-219037.8Windows GDI Elevation of Privilege VulnerabilityCVE-2022-219047.5Windows GDI Information Disclosure VulnerabilityCVE-2022-219058.0Windows Hyper-V Security Feature Bypass VulnerabilityCVE-2022-219065.5Windows Defender Application Control Security Feature Bypass VulnerabilityCVE-2022-219079.8HTTP Protocol Stack Remote Code Execution VulnerabilityCVE-2022-219087.8Windows Installer Elevation of Privilege VulnerabilityCVE-2022-21917.5In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByCVE-2022-219107.8Microsoft Cluster Port Driver Elevation of Privilege VulnerabilityCVE-2022-219117.5.NET Framework Denial of Service Vulnerability
CVE-2022-2190: Medium severity, CVSS 6.1 | Vulnix