HomeWordPress vulnerabilitiesEnvira Gallery
Envira Gallery vulnerabilities
Envira Gallery has 9 known vulnerabilities in this database. The most recent published record is dated 7 Oct 2026.
- Known vulnerabilities
- 9
- Active installs
- 100,000+
- Latest version
- 1.16.0
- Last updated
- 8 Sep 2026
- Most recent
- 7 Oct 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Cross-site scripting (XSS) CVE-2026-104652 | Medium 6.8 | Before 1.16.1 | Fixed in 1.16.1 | 18 h ago |
| Cross-site scripting (XSS) CVE-2026-104653 | Medium 6.8 | Before 1.16.1 | Fixed in 1.16.1 | 18 h ago |
| Cross-site scripting (XSS) CVE-2026-3423 | Medium 6.4 | Up to 1.12.4 | Fixed in a later version (latest 1.16.0) | 28 Aug 2026 |
| Cross-site scripting (XSS) CVE-2026-5361 | Medium 6.4 | Up to 1.12.4 | Fixed in a later version (latest 1.16.0) | 14 May 2026 |
| Cross-site scripting (XSS) CVE-2026-1236 | Medium 6.4 | Up to 1.12.3 | Fixed in a later version (latest 1.16.0) | 4 Mar 2026 |
| Broken access control CVE-2025-12377 | Medium 4.3 | Up to 1.12.0 | Fixed in a later version (latest 1.16.0) | 13 Nov 2025 |
| Broken access control CVE-2025-11448 | Medium 4.3 | Up to 1.11.0 | Fixed in a later version (latest 1.16.0) | 8 Nov 2025 |
| Broken access control CVE-2023-6742 | Medium 4.3 | Up to 1.8.7.1 | Fixed in a later version (latest 1.16.0) | 11 Jan 2024 |
| Cross-site scripting (XSS) CVE-2020-9334 | Medium 5.4 | Up to 1.7.6 | Fixed in a later version (latest 1.16.0) | 25 Feb 2020 |
Read the published descriptions
- CVE-2026-104652, 7 Oct 2026
- The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery. CVE record
- CVE-2026-104653, 7 Oct 2026
- The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery. CVE record
- CVE-2026-3423, 28 Aug 2026
- The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled. CVE record
- CVE-2026-5361, 14 May 2026
- The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due to insufficient input sanitization in the update_gallery_data() function and improper output escaping in the gallery_init() function. The sanitize_config_values() function only sanitizes the justified_gallery_theme and justified_row_height parameters, but does not sanitize the arrows parameter. When the arrows value is output in the inline JavaScript configuration, it uses esc_attr() which is designed for HTML attribute contexts, not JavaScript contexts, allowing JavaScript expression injection. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2026-1236, 4 Mar 2026
- The Envira Gallery for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'justified_gallery_theme' parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2025-12377, 13 Nov 2025
- The Gallery Plugin for WordPress - Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-level access and above, to perform multiple actions, such as removing images from arbitrary galleries. The vulnerability was partially patched in version 1.12.0. CVE record
- CVE-2025-11448, 8 Nov 2025
- The Gallery Plugin for WordPress - Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries. CVE record
- CVE-2023-6742, 11 Jan 2024
- The Gallery Plugin for WordPress - Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'envira_gallery_insert_images' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify galleries on other users' posts. CVE record
- CVE-2020-9334, 25 Feb 2020
- A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users. CVE record
What to do if you run Envira Gallery
If you run Envira Gallery, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Envira Gallery vulnerabilities
Free. We email you when a new vulnerability is published for Envira Gallery, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.