Vulnerability · Published Sep 5, 2022 · Assigned by WPScan
CVE-2022-2543Visual Portfolio < 2.18.0 - Unauthenticated CSS Injection
Medium 6.1
In plain English
A medium-severity missing authorization in Visual Portfolio, Photo Gallery & Post Grid from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)0.6%top 50.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Visual Portfolio, Photo Gallery & Post Grid | 2.18.0 – before 2.18.0 |
Weakness: CWE-862