Skip to content
OpenAdvisories

Vendor

GhozyLab

17 known vulnerabilities.

GhozyLab at a glance

Last 12 months
4
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202610
Aug 202600
Jul 202600
Jun 202610
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202500
Sep 202510
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202510
Mar 202520
Feb 202520
Jan 202500
Dec 202400

Products

Popup Builder 3 Gallery for Social Photo 2 Image Slider Widget 2 Gallery Lightbox 2 Web Icons 2 Image Carousel 1 Gallery – Photo Albums Plugin 1 Easy Notify Lite 1 Image Slider 1 WP Composer – The Easiest Page Builder 1 Easy Contact Form Lite 1
All Critical High Medium Low Exploited only Public exploit

17 results · Feed

  • Medium 6.5
    CVE-2026-42700

    WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130.

    GhozyLab Image Slider Widget
  • Medium 6.4
    CVE-2026-2422

    WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode

    The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded conte…

    GhozyLab WP Composer – The Easiest Page Builder Web / CMS
  • Medium 6.5
    CVE-2025-68074

    WordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.

    GhozyLab Image Carousel
  • Medium 5.4
    CVE-2025-14446

    Popup Builder <= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset

    The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotify_cp_reset() function in all versions up to, and including, 1.1.37. This makes it possible for authe…

    GhozyLab Easy Notify Lite Web / CMS
  • Medium 6.5
    CVE-2025-57966

    WordPress Gallery Lightbox plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery Lightbox gallery-lightbox-slider allows Stored XSS.This issue affects Gallery Lightbox: from n/a through <= 1.0.0.41.

    GhozyLab Gallery Lightbox
  • High 7.5
    CVE-2025-46230

    WordPress Popup Builder plugin <= 1.1.35 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GhozyLab Popup Builder easy-notify-lite allows PHP Local File Inclusion.This issue affects Popup Builder: from n/a through <= 1.1.35.

    GhozyLab Popup Builder
  • Medium 6.5
    CVE-2025-31586

    WordPress Gallery – Photo Albums Plugin plugin <= 1.3.170 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery – Photo Albums Plugin easy-media-gallery allows Stored XSS.This issue affects Gallery – Photo Albums Plugin: from n/a through <= 1.3.170.

    GhozyLab Gallery – Photo Albums Plugin
  • Medium 6.5
    CVE-2025-26742

    WordPress Gallery for Social Photo plugin <= 1.0.0.35 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery for Social Photo feed-instagram-lite allows Stored XSS.This issue affects Gallery for Social Photo: from n/a through <= 1.0.0.35.

    GhozyLab Gallery for Social Photo
  • Medium 6.5
    CVE-2025-26962

    WordPress Contact Form Plugin plugin <= 1.1.25 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Easy Contact Form Lite contact-form-lite allows Stored XSS.This issue affects Easy Contact Form Lite : from n/a through <= 1.1.25.

    GhozyLab Easy Contact Form Lite
  • Medium 6.5
    CVE-2025-26882

    WordPress Popup Builder plugin <= 1.1.33 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Popup Builder easy-notify-lite allows Stored XSS.This issue affects Popup Builder: from n/a through <= 1.1.33.

    GhozyLab Popup Builder
  • Medium 5.9
    CVE-2024-47623

    WordPress Gallery Lightbox plugin <= 1.0.0.39 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery Lightbox gallery-lightbox-slider allows Stored XSS.This issue affects Gallery Lightbox: from n/a through <= 1.0.0.39.

    GhozyLab Gallery Lightbox
  • Medium 6.5
    CVE-2024-34567

    WordPress Easy Notify Lite plugin <= 1.1.29 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 1.1.29.

    GhozyLab Popup Builder
  • Medium 5.9
    CVE-2024-32707

    WordPress Image Slider plugin <= 1.1.125 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.125.

    GhozyLab Image Slider Widget
  • Medium 6.5
    CVE-2024-30445

    WordPress Web Icons plugin <= 1.0.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab, Inc. Web Icons allows Stored XSS.This issue affects Web Icons: from n/a through 1.0.0.10.

    GhozyLab Web Icons
  • Medium 6.5
    CVE-2024-29933

    WordPress Web Icons plugin <= 1.0.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab, Inc. Web Icons allows Stored XSS.This issue affects Web Icons: from n/a through 1.0.0.10.

    GhozyLab Web Icons
  • Medium 5.4
    CVE-2022-2224

    Gallery for Social Photo <= 1.0.0.27 - Cross-Site Request Forgery to Post Duplication

    The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly check for the existence of a nonce in the function gifeed_duplicate_feed. This make it possible for …

    GhozyLab Gallery for Social Photo Web / CMS
  • Medium 5.4
    CVE-2022-2223

    Image Slider <= 1.1.121 - Cross-Site Request Forgery to Post Duplication

    The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the existence of a nonce in the function ewic_duplicate_slider. This make it possible for unauthenticat…

    GhozyLab Image Slider Web / CMS