CVE-2022-2597

CVE-2022-2597: Visual Portfolio < 2.19.0 - Contributor+ CSS Injection

Vendor Unknown

Product Visual Portfolio, Photo Gallery & Post Grid

Weakness CWE-863 · Incorrect authorization

Published September 5, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts

Key dates

02Disclosure timeline

September 5, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2597

Related vulnerabilities

04Related CVE

CVE-2025-54263 Adobe Commerce | Incorrect Authorization (CWE-863) CVE-2025-4128 Mattermost Guest User Information Disclosure Vulnerability CVE-2020-7300 DLP ePO extension - Improper Authorization CVE-2023-51380 Incorrect Authorization allows Read Access to Issue Comments in GitHub Enterprise Server CVE-2025-68140 EVerest allows null session ID to bypass session ID verification