CVE-2015-7386 - CVE House

Back to Database

Status published Low CVE-2015-7386

Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery...

3.5 CVSS

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-7386

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from ghozylab

View All →

Popup Builder <= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset

Gallery for Social Photo <= 1.0.0.27 - Cross-Site Request Forgery to Post Duplication

Image Slider <= 1.1.121 - Cross-Site Request Forgery to Post Duplication

Affected Vendor

ghozylab

View all reports →

Affected Software

gallery - photo albums - portfolio

Vulnerable Versions:

1.3.47

Timeline

Official Publish: September 28th, 2015

Last Modified: September 16th, 2024

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.