Photo Gallery WordPress v1.6.3 - SQL Injection
CVE-2022-1281
Verified
Description
Photo Gallery WordPress plugin v1.6.3 contains a SQL injection caused by improper escaping of $_POST['filter_tag'] parameter in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires sending crafted POST requests.
Severity
Critical
CVSS Score
9.8
Exploit Probability
43%
Published Date
August 17, 2026
Template Author
theamanrawat
CVE-2022-1281.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2022-1281
CWE ID:
cwe-89
Remediation Steps
Update to the latest version of the plugin where the issue is fixed.