CVE-2022-2597: Visualportfolio Visual Portfolio, Photo Gallery & Post Grid

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts

Affected products

• Visualportfolio Visual Portfolio, Photo Gallery & Post Grid: before 2.19.0 (fixed in 2.19.0)

Published 2022-09-05. Last modified 2026-06-17.