CVE-2022-2543: Visual Portfolio < 2.18.0 - Unauthenticated CSS Injection

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-05 · updated 2026-06-17
Weakness: CWE-862

Description

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts

Affected products

Visual Portfolio, Photo Gallery & Post Grid: before 2.18.0 — fixed in 2.18.0

How to fix

Upgrade to a fixed version: Visual Portfolio, Photo Gallery & Post Grid 2.18.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/5dc8b671-f2fa-47be-8664-9005c4fdbea8
https://wpscan.com/vulnerability/5dc8b671-f2fa-47be-8664-9005c4fdbea8

Get alerted when CVE-2022-2543 or the next vulnerability affects your stack