LCweb vulnerabilities

Products

• Global Gallery 3
• PrivateContent 2
• Global Gallery - WordPress Responsive Gallery 1
• PrivateContent - Mail Actions 1

Latest LCweb CVEs

Newest publication first

1. CVE-2026-73184 WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability

   Published 2026-08-19

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.

2. CVE-2026-57692 WordPress PrivateContent plugin <= 9.9.2 - Privilege Escalation vulnerability

   Published 2026-07-01

   Critical·CVSS 9.8 EPSS 0.53%

   Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2.

3. CVE-2025-52721 WordPress Global Gallery Plugin <= 9.2.3 - Broken Access Control Vulnerability

   Published 2025-08-14

   Medium·CVSS 6.5 EPSS 0.29%

   Missing Authorization vulnerability in LCweb Global Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Global Gallery: from n/a through 9.2.3.

4. CVE-2025-47627 WordPress PrivateContent - Mail Actions plugin <= 2.3.2 - Local File Inclusion vulnerability

   Published 2025-07-04

   High·CVSS 7.5 EPSS 0.62%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LCweb PrivateContent - Mail Actions allows PHP Local File Inclusion. This issue affects PrivateContent - Mail Actions: from n/a through 2.3.2.

5. CVE-2024-13814 Global Gallery - WordPress Responsive Gallery <= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

   Published 2025-02-12

   High·CVSS 8.8 EPSS 0.53%

   The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before ru...

6. CVE-2023-0581 PrivateContent <= 8.4.3 - Protection Mechanism Bypass

   Published 2023-01-30

   Medium·CVSS 5.3 EPSS 0.73%

   The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. T...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.