gb-plugins vulnerabilities

Products

• gb gallery slideshow 3
• GB Forms DB 1

Latest gb-plugins CVEs

Newest publication first

1. CVE-2025-5392 GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution

   Published 2025-07-11

   Critical·CVSS 9.8

   The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdb_talk_to_front() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible...

2. CVE-2025-32649 WordPress GB Gallery Slideshow Plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

   Published 2025-04-17

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gb-plugins GB Gallery Slideshow gb-gallery-slideshow allows Reflected XSS.This issue affects GB Gallery Slideshow: from n/a through <= 1.3.

3. CVE-2025-31732 WordPress GB Gallery Slideshow plugin <= 1.3 - Broken Access Control vulnerability

   Published 2025-04-01

   Medium·CVSS 4.3

   Missing Authorization vulnerability in gb-plugins GB Gallery Slideshow gb-gallery-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GB Gallery Slideshow: from n/a through <= 1.3.

4. CVE-2014-8375 SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a g...

   Published 2014-10-21

   Medium·CVSS 6.5 Public exploit

   SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a gb_ajax_get_group action to wp-admin/admin-ajax.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.