Vulnerabilities and security researches forwoo-product-gallery-slider woo-product-gallery-slider

Jun 07, 2024

CVE, Research URL: CVE-2022-45372
Home page URL: Security reports for Product Gallery Slider, Additional Variation Images for WooCommerce
Application: Product Gallery Slider, Additional Variation Images for WooCommerce
Date: May 29, 2023
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.
Affected versions: max 2.2.9.
Status: vulnerable

CVE, Research URL: 1a2b428b1446a7366a3003aa039bcf7b5cebb334
Home page URL: Security reports for Product Gallery Slider, Additional Variation Images for WooCommerce
Application: Product Gallery Slider, Additional Variation Images for WooCommerce
Date: Mar 21, 2023
Research Description: Product Gallery Slider, Additional Variation Images for WooCommerce [woo-product-gallery-slider] < 2.2.7 WordPress Product Gallery Slider for WooCommerce Plugin <= 2.2.6 is vulnerable to Cross Site Request Forgery (CSRF) Update the WordPress Product Gallery Slider for WooCommerce plugin to the latest available version (at least 2.2.7). Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Product Gallery Slider for WooCommerce Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 2.2.7.
Affected versions: max 2.2.7.
Status: vulnerable

Nov 04, 2026

CVE, Research URL: CVE-2026-120318
Home page URL: Security reports for Product Gallery Slider, Additional Variation Images for WooCommerce
Application: Product Gallery Slider, Additional Variation Images for WooCommerce
Date: Nov 02, 2026
Research Description: Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.
Affected versions: max 2.3.26.
Status: vulnerable