CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Explanation of Vulnerability in Simple Terms
Global Gallery versions up to 9.1.5 contain a code injection vulnerability that allows authenticated users with low privileges to inject and execute arbitrary code. An attacker can read sensitive data and modify site content. The vulnerability requires a valid WordPress user account but no additional user interaction.
What an attacker can do
Inject and run arbitrary code on the site to read data and modify content.
Potential impact on your site
Any logged-in user can inject code to access sensitive data or alter site content without admin approval.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
