Threat database

The Gmedia Photo Gallery WordPress plugin up to version 1.25.1 contains a time-based SQL Injection vulnerability via the 'gmedia__in' parameter. This flaw allows unauthenticated attackers to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. The vulnerability is exploitable without any authentication because the mobile app endpoint dispatches the library action without validating feature flags, nonces, or user sessions.

The Filter Everything — WordPress & WooCommerce Filters plugin is affected by a reflected cross-site scripting (XSS) vulnerability in versions up to and including 1.9.6. This vulnerability arises from improper input sanitization and output escaping in the flrt_elementor_load_more_anchor() function, which processes URL query parameters insecurely. An unauthenticated attacker can craft a malicious link that injects arbitrary scripts into pages, potentially executing them when a user interacts with the link.

CVE-2026-39785 is a critical SQL Injection vulnerability in Serhii Pasyuk's Gmedia Photo Gallery affecting versions up to 1.25.1. The flaw allows an attacker to perform Blind SQL Injection due to improper neutralization of special elements in SQL commands. This vulnerability can lead to high confidentiality impact and partial availability impact without requiring user interaction or privileges.

Cross-Site Request Forgery (CSRF) vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Cross Site Request Forgery.This issue affects Gmedia Photo Gallery: from n/a through <= 1.25.0.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows PHP Local File Inclusion.This issue affects Gmedia Photo Gallery: from n/a through <= 1.23.0.

Cross-Site Request Forgery (CSRF) vulnerability in Stepan Stepasyuk MemeOne allows Stored XSS.This issue affects MemeOne: from n/a through 2.0.5.