← Database

CVE-2022-4063

CRITICAL CVSS: 9.8 Published: 2022-12-19 Modified: 2026-06-17

Description

The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.

Affected Platforms

Pluginus Inpost Gallery

Weakness Type

CWE-22

References