CVE-2022-1281

CRITICAL EXPLOITED

10web Photo Gallery < 1.6.3 - SQL Injection via filter_tag Parameter

Title source: llm

Exploitation Summary

CVE-2022-1281 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/2b4866f2-f511-41c6-8135-cf1e0263d8de

Patch, Third Party Advisory x_refsource_confirm

https://plugins.trac.wordpress.org/changeset/2706797/photo-gallery/trunk/frontend/models/BWGModelGalleryBox.php?old=2587758&old_path=photo-gallery%2Ftrunk%2Ffrontend%2Fmodels%2FBWGModelGalleryBox.php

Scores

CVSS v3 9.8

EPSS 0.2346

EPSS Percentile 97.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2026-05-04

CWE

CWE-89

Status published

Products (1)

10web/photo_gallery < 1.6.3

Published May 02, 2022

Tracked Since Feb 18, 2026