CVE-2022-2543

PoC —

CVSS 3.1

6.1 medium

EPSS

<1%p46

Published

Sep 5, 2022 (Sep 5, 2022)

Modified

Jun 17, 2026

Description

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts

Vendors: visualportfolio
Products: visual portfolio\, photo gallery \& post grid
Ecosystems: WordPress
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.