CVE-2014-8758

Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in the gallery_album_sorting page to wp-admin/admin.php.

• CWE-79

• https://g0blin.co.uk/cve-2014-8758/Exploit, Release Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8236Third Party Advisory
• https://g0blin.co.uk/cve-2014-8758/Exploit, Release Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/8236Third Party Advisory

Published

Oct 6, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-8752Multiple cross-site scripting (XSS) vulnerabilities in view.…
• CVE-2014-8753Multiple cross-site scripting (XSS) vulnerabilities in Cit-e…
• CVE-2014-8754Open redirect vulnerability in track-click.php in the Ad-Man…
• CVE-2014-8755Panasonic Network Camera View 3 and 4 allows remote attacker…
• CVE-2014-8756The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Rec…
• CVE-2014-8757LG On-Screen Phone (OSP) before 4.3.010 allows remote attack…
• CVE-2014-8760ejabberd before 2.1.13 does not enforce the starttls_require…
• CVE-2014-8761inc/template.php in DokuWiki before 2014-05-05a only checks …
• CVE-2014-8762The ajax_mediadiff function in DokuWiki before 2014-05-05a a…
• CVE-2014-8763DokuWiki before 2014-05-05b, when using Active Directory for…
• CVE-2014-8764DokuWiki 2014-05-05a and earlier, when using Active Director…
• CVE-2014-8765Multiple cross-site scripting (XSS) vulnerabilities in the P…