← Database

CVE-2022-2597

MEDIUM CVSS: 5.4 Published: 2022-09-05 Modified: 2026-06-17

Description

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts

Affected Platforms

Visualportfolio Visual Portfolio\, Photo Gallery \& Post Grid

Weakness Type

CWE-863

References