Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The PhotoStack Gallery plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up to, and including, 0.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-14 | 2 | Disclosure2 |
| 2026-02-15 | 1 | Patch1 |
CVE-2026-2024 The PhotoStack Gallery plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up to, and including, 0.4.1 due to insufficient es… https://www.cve.org/CVERecord?id=CVE-2026-2024
Post summary
CVE-2026-2024 exposes the PhotoStack Gallery plugin (≤0.4.1) to SQL injection via the 'postid' parameter; the post lists the CVE but provides no PoC, exploit code, or patch details.
🚨 HIGH severity SQL Injection in PhotoStack Gallery WordPress plugin (all versions). Unauthenticated attackers can extract sensitive DB info! Disable or remove plugin ASAP. Details: https://radar.offseq.com/threat/cve-2026-2024-cwe-89-improper-neutralization-of-sp-e9679b86 #Of... https://t.co/XsER1C0QMJ
Post summary
The tweet announces a high‑severity SQL injection in all versions of PhotoStack Gallery and recommends disabling or removing the plugin as a mitigation.
CVE-2026-2024 SQL Injection in WordPress PhotoStack Gallery Plugin Versions 0.4.1 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2024
Post summary
CVE-2026-2024 is a SQL Injection vulnerability affecting WordPress PhotoStack Gallery Plugin versions 0.4.1 and below; no PoC, exploit code, active exploitation, or patch details are provided.