HomeWordPress vulnerabilitiesPhoto Gallery, Sliders, Proofing and Themes
Photo Gallery, Sliders, Proofing and Themes vulnerabilities
Photo Gallery, Sliders, Proofing and Themes has 25 known vulnerabilities in this database. The most recent published record is dated 20 May 2026.
- Known vulnerabilities
- 25
- Active installs
- 300,000+
- Latest version
- 4.5.1
- Last updated
- 18 Sep 2026
- Most recent
- 20 May 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Broken access control CVE-2026-6566 | Medium 4.3 | Up to 4.2.0 | Fixed in a later version (latest 4.5.1) | 20 May 2026 |
| File inclusion CVE-2026-1463 | High 8.8 | Up to 4.0.3 | Fixed in a later version (latest 4.5.1) | 18 Mar 2026 |
| Remote code execution CVE-2025-13641 | High 8.8 | Up to 3.59.12 | Fixed in a later version (latest 4.5.1) | 18 Dec 2025 |
| Cross-site scripting (XSS) CVE-2024-5878 | Medium 6.4 | Not yet published | Check for an update | 20 May 2025 |
| Cross-site scripting (XSS) CVE-2024-10545 | Low 3.5 | Before 3.59.9 | Fixed in 3.59.9 | 25 Feb 2025 |
| Cross-site scripting (XSS) CVE-2024-6393 | Medium 4.8 | Before 3.59.5 | Fixed in 3.59.5 | 25 Nov 2024 |
| Cross-site scripting (XSS) CVE-2024-5442 | Medium 5.9 | Before 3.59.3 | Fixed in 3.59.3 | 13 Jul 2024 |
| Cross-site scripting (XSS) CVE-2024-2744 | Medium 4.3 | Before 3.59.1 | Fixed in 3.59.1 | 17 May 2024 |
| Broken access control CVE-2024-3097 | Medium 5.3 | Before 3.59.1 | Fixed in 3.59.1 | 9 Apr 2024 |
| Cross-site request forgery (CSRF) CVE-2023-48328 | Medium 4.3 | Before 3.39 | Fixed in 3.39 | 30 Nov 2023 |
| PHP object injection CVE-2023-3154 | High 7.5 | Before 3.39 | Fixed in 3.39 | 16 Oct 2023 |
| Arbitrary file read CVE-2023-3155 | High 7.2 | Before 3.39 | Fixed in 3.39 | 16 Oct 2023 |
| Security weakness CVE-2023-3279 | Medium 4.9 | Before 3.39 | Fixed in 3.39 | 16 Oct 2023 |
| Cross-site request forgery (CSRF) CVE-2022-38468 | Medium 4.3 | Before 3.29 | Fixed in 3.29 | 1 Mar 2023 |
| Cross-site scripting (XSS) CVE-2021-24293 | Medium 6.1 | Before 3.1.11 | Fixed in 3.1.11 | 5 May 2021 |
| Cross-site request forgery (CSRF) CVE-2020-35943 | Medium 6.5 | Before 3.5.0 | Fixed in 3.5.0 | 9 Feb 2021 |
| Cross-site scripting (XSS) CVE-2020-35942 | High 8.8 | Before 3.5.0 | Fixed in 3.5.0 | 9 Feb 2021 |
| Arbitrary file upload CVE-2013-3684 | Critical 9.8 | Before 1.9.13 | Fixed in 1.9.13 | 11 Feb 2020 |
| Sensitive data exposure CVE-2013-0291 | High 7.5 | Not yet published | Check for an update | 30 Jan 2020 |
| Cross-site scripting (XSS) CVE-2015-9537 | Medium 5.4 | Before 2.1.10 | Fixed in 2.1.10 | 26 Nov 2019 |
| Path traversal CVE-2015-9538 | Medium 6.5 | Before 2.1.15 | Fixed in 2.1.15 | 26 Nov 2019 |
| SQL injection CVE-2019-14314 | Critical 9.8 | Before 3.2.10 | Fixed in 3.2.10 | 27 Aug 2019 |
| SQL injection CVE-2016-10889 | Critical 9.8 | Before 2.1.57 | Fixed in 2.1.57 | 14 Aug 2019 |
| Path traversal CVE-2018-7586 | High 7.5 | Up to 2.2.46 | Fixed in a later version (latest 4.5.1) | 1 Mar 2018 |
| Arbitrary file upload CVE-2015-9228 | High 8.8 | Not yet published | Check for an update | 12 Sep 2017 |
Read the published descriptions
- CVE-2026-6566, 20 May 2026
- The Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default). CVE record
- CVE-2026-1463, 18 Mar 2026
- The Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.3 via the 'template' parameter in gallery shortcodes. This makes it possible for authenticated attackers, with Author-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. CVE record
- CVE-2025-13641, 18 Dec 2025
- The Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter. This is due to insufficient path validation that allows absolute paths to be provided. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, bypassing web server restrictions like .htaccess. Successful exploitation could lead to information disclosure, code execution in the WordPress context, and potential remote code execution if combined with arbitrary file upload capabilities. CVE record
- CVE-2024-5878, 20 May 2025
- Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-10545, 25 Feb 2025
- The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) CVE record
- CVE-2024-6393, 25 Nov 2024
- The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) CVE record
- CVE-2024-5442, 13 Jul 2024
- The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVE record
- CVE-2024-2744, 17 May 2024
- The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed CVE record
- CVE-2024-3097, 9 Apr 2024
- The WordPress Gallery Plugin - NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin. CVE record
- CVE-2023-48328, 30 Nov 2023
- Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin - NextGEN Gallery allows Cross Site Request Forgery.This issue affects WordPress Gallery Plugin - NextGEN Gallery: from n/a through 3.37. CVE record
- CVE-2023-3154, 16 Oct 2023
- The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server. CVE record
- CVE-2023-3155, 16 Oct 2023
- The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server. CVE record
- CVE-2023-3279, 16 Oct 2023
- The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks CVE record
- CVE-2022-38468, 1 Mar 2023
- Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin - NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration. CVE record
- CVE-2021-24293, 5 May 2021
- In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript. CVE record
- CVE-2020-35943, 9 Feb 2021
- A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.) CVE record
- CVE-2020-35942, 9 Feb 2021
- A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.) CVE record
- CVE-2013-3684, 11 Feb 2020
- NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload CVE record
- CVE-2013-0291, 30 Jan 2020
- NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability CVE record
- CVE-2015-9537, 26 Nov 2019
- The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template. CVE record
- CVE-2015-9538, 26 Nov 2019
- The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection. CVE record
- CVE-2019-14314, 27 Aug 2019
- A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php. CVE record
- CVE-2016-10889, 14 Aug 2019
- The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name. CVE record
- CVE-2018-7586, 1 Mar 2018
- In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured. CVE record
- CVE-2015-9228, 12 Sep 2017
- In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php. CVE record
What to do if you run Photo Gallery, Sliders, Proofing and Themes
If you run Photo Gallery, Sliders, Proofing and Themes, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Photo Gallery, Sliders, Proofing and Themes vulnerabilities
Free. We email you when a new vulnerability is published for Photo Gallery, Sliders, Proofing and Themes, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.