What’s Vulnerable › Vulnerabilities

CVE-2022-4060: User Post Gallery <= 2.19 - Unauthenticated RCE

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 42.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-16 · updated 2026-06-17

Description

The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.

Affected products

• User Post Gallery: through 2.19

References

• https://wpscan.com/vulnerability/8f982ebd-6fc5-452d-8280-42e027d01b1e
• https://wpscan.com/vulnerability/8f982ebd-6fc5-452d-8280-42e027d01b1e

Get alerted when CVE-2022-4060 or the next vulnerability affects your stack