CVE-2022-4063

PoC —

CVSS 3.1

9.8 critical

EPSS

10%p95

Published

Dec 19, 2022 (Dec 19, 2022)

Modified

Jun 17, 2026

Description

The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.

Vendors: pluginus
Products: inpost gallery
Ecosystems: WordPress
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (9.5%)

In the news0 stories

No ingested article mentions this CVE yet.