CVE-2022-4060

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.

9.8

CVSS

42.7%

EPSS (exploit prob.)

99th

EPSS percentile

2023-01-16

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
odude	user_post_gallery	<= 2.19

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/8f982ebd-6fc5-452d-8280-42e027d01b1e
https://wpscan.com/vulnerability/8f982ebd-6fc5-452d-8280-42e027d01b1e

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-4060