CVE-2022-4063: Pluginus Inpost Gallery

Critical severity, CVSS 9.8. EPSS: 9.6% chance of exploitation in the next 30 days.

The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.

Affected products

• Pluginus Inpost Gallery: before 2.1.4.1 (fixed in 2.1.4.1)

Published 2022-12-19. Last modified 2026-06-17.