cve/2022/CVE-2022-2597.md

### [CVE-2022-2597](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2597)
![](https://img.shields.io/static/v1?label=Product&message=Visual%20Portfolio%2C%20Photo%20Gallery%20%26%20Post%20Grid&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.19.0%3C%202.19.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%20Incorrect%20Authorization&color=brighgreen)

### Description

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts

### POC

#### Reference
- https://wpscan.com/vulnerability/3ffcee7c-1e03-448c-8006-a9405658cdb7

#### Github
No PoCs found on GitHub currently.