title: Visual Portfolio < 2.19.0 - Contributor+ CSS Injection
description: The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts
problem types: CWE-863 Incorrect Authorization
affected:
{
product: Visual Portfolio, Photo Gallery & Post Grid
vendor: Unknown
versions:
lessThan: 2.19.0, status: affected, version: 2.19.0, versionType: custom
}