CVE-2022-2543

CVE-2022-2543: Visual Portfolio < 2.18.0 - Unauthenticated CSS Injection

Vendor Unknown

Product Visual Portfolio, Photo Gallery & Post Grid

Weakness CWE-862 · Missing authorization

Published September 5, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts

Key dates

02Disclosure timeline

September 5, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2543 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2025-66138 WordPress Motionger for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability CVE-2024-0900 Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! <= 2.1.2 - Missing Authorization to Subscriber+ Arbitrary Post Creation CVE-2025-58594 WordPress Brizy Plugin <= 2.7.12 - Broken Access Control Vulnerability CVE-2026-39594 WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability CVE-2024-56217 WordPress Download Manager plugin <= 3.3.03 - Broken Access Control vulnerability