PT-2025-30023 · WordPress · Balbooa Gallery

Kamil Szczurowski + 1 · Published 2025-07-18 · Updated 2025-07-18 · CVE-2025-49486

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Balbooa Gallery plugin versions 1.0.0 through 2.4.0

Description A stored cross-site scripting (XSS) issue exists in the Balbooa Gallery plugin for Joomla. Privileged users can store malicious scripts within gallery items.

Recommendations Update Balbooa Gallery plugin to a version later than 2.4.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-49486

Affected Products

Balbooa Gallery

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-49486 · Security Note
• https://extensions.joomla.org/extension/gallery · Note
• https://twitter.com/CVEnew/status/1946153084922503247 · Twitter Post
• https://t.me/cvenotify/129420 · Telegram Post
• https://t.me/cvetracker/28129 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1946175638643040744 · Twitter Post