Vulnerabilities
Summary — last 7 days
New vulnerabilities5,115▲ 1,966 vs. last week
Critical / high2,827▲ 1,289 vs. last week
New active exploitation (KEV)9▲ 4 vs. last week
Unscored (no CVSS)197▼ 10 vs. last week
10 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (7.1) | 0.18% | — | Maxfoundry MaxgalleriaAI | 10/1/2026 | 10/1/2026 | Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions. | |
| Deferred | Medium (6.5) | 0.47% | — | Fullscreen GalleriaAI | 8/16/2026 | 8/20/2026 | The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for… | |
| Deferred | Medium (4.3) | 0.24% | — | Maxgalleria Media Library FoldersAI | 2/14/2026 | 6/17/2026 | The Media Library Folders plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 8.3.6 via the delete_maxgalleria_media() and maxgalleria_rename_image() functions due to missing validation on a user controlled key. This makes it possible for authenticated… | |
| Deferred | High (7.1) | 0.39% | — | S Wordpress Galleria WP GalleriaAI | 4/1/2025 | 6/17/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S WordPress Galleria wp-galleria allows Reflected XSS.This issue affects WordPress Galleria: from n/a through <= 1.4. | |
| Deferred | Medium (6.4) | 0.27% | — | Maxfoundry MaxgalleriaAI | 6/18/2024 | 6/17/2026 | The MaxGalleria plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's maxgallery_thumb shortcode in all versions up to, and including, 6.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with… | |
| Deferred | Medium (4.3) | 0.61% | — | Maxfoundry MaxgalleriaAI | 5/2/2024 | 6/17/2026 | The MaxGalleria plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the add_media_library_images_to_gallery function in all versions up to, and including, 6.4.2. This makes it possible for authenticated attackers, with subscriber access or above, to upload arbitrary… | |
| Deferred | Medium (6.5) | 0.35% | — | Petri Damsten Fullscreen GalleriaAI | 3/27/2024 | 6/17/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Petri Damstén Fullscreen Galleria allows Stored XSS.This issue affects Fullscreen Galleria: from n/a through 1.6.11. | |
| Modified | Medium (6.5) | 0.22% | — | Galleria Project Galleria | 7/11/2023 | 6/17/2026 | Cross-Site Request Forgery (CSRF) vulnerability in Andy Whalen Galleria plugin <= 1.0.3 versions. | |
| Modified | Medium (4.8) | 0.56% | — | Maxfoundry Maxgalleria | 3/18/2022 | 6/17/2026 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5). | |
| Modified | Medium (6.8) | 3.8% | 💥 Exploit | Miro International Galleria | 7/6/2006 | 6/16/2026 | PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. |