CVE-2022-2543: unknown visual portfolio, photo gallery & post grid Missing Authorization

Vulnerability summary

CVE-2022-2543 is a medium (CVSS 6.1) Missing Authorization vulnerability in unknown visual portfolio, photo gallery & post grid. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-09-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.