Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Photo GalleryImage Photo Gallery Final Tiles GridPhoto Gallery, Sliders, Proofing and简数采集器Photo Gallery, Images, Slider in Rbs Image GalleryEnvira Photo GalleryGmedia Photo GalleryPhoto Gallery
Plugin · nextgen-gallery
Photo Gallery, Sliders, Proofing and
29 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Photo Gallery, Sliders, Proofing and safe? The full page →
Sep 30, 2026Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.CVE-2026-94123 · affects up to 4.5.0 · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not check that a user holds its options capability before saving image sizing settingsCVE-2026-81654 · fixed in 4.5.0 · reported by WPScanLow 3.1
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the user acting on an image owns the gallery it belongs toCVE-2026-81653 · fixed in 4.5.0 · reported by WPScanMedium 4.2
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the requesting user is entitled to a given image record before returning itCVE-2026-81652 · fixed in 4.5.0 · reported by WPScanLow 2.7
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the user saving a gallery owns itCVE-2026-81651 · fixed in 4.5.0 · reported by WPScanLow 3.1
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not correctly validate the extensions of files extracted from an uploaded archiveCVE-2026-81650 · fixed in 4.5.0 · reported by WPScanHigh 7.2
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.CVE-2026-28141 · affects up to 4.2.3 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
May 20, 2026Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Insecure Direct Object ReferenceCVE-2026-6566 · affects up to 4.2.0 · reported by WordfenceMedium 4.3
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well as their associated image files from disk when deleteImg is enabled (default).
Mar 18, 2026Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Local File InclusionCVE-2026-1463 · affects up to 4.0.3 · reported by WordfenceHigh 8.8
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.3 via the 'template' parameter in gallery shortcodes. This makes it possible for authenticated attackers, with Author-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2025Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Local File InclusionCVE-2025-13641 · affects up to 3.59.12 · reported by WordfenceHigh 8.8
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter. This is due to insufficient path validation that allows absolute paths to be provided. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, bypassing web server restrictions like .htaccess. Successful exploitation could lead to information disclosure, code execution in the WordPress context, and potential remote code execution if combined with arbitrary file upload capabilities.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 20, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in varioCVE-2024-5878 · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 25, 2025Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Image settingsCVE-2024-10545 · fixed in 3.59.9 · reported by WPScanLow 3.5
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Nov 25, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Images settingsCVE-2024-6393 · fixed in 3.59.5 · reported by WPScanMedium 4.8
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Aug 1, 2024NextGEN Gallery: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39627 · affects up to 3.59.3 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Imagely NextGEN Gallery allows Stored XSS.This issue affects NextGEN Gallery: from n/a through 3.59.3.
Jul 13, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its settingsCVE-2024-5442 · fixed in 3.59.3 · reported by WPScanMedium 5.9
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
May 17, 2024NextGEN Gallery: Does not sanitise and escape some of its settingsCVE-2024-2744 · fixed in 3.59.1 · reported by WPScanMedium 4.3
The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Apr 9, 2024WordPress Gallery Plugin – NextGEN Gallery: Unauthorized access of dataCVE-2024-3097 · affects up to 3.59 · reported by WordfenceMedium 5.3
The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 30, 2023WordPress Gallery Plugin – NextGEN Gallery: Cross-Site Request Forgery (CSRF)CVE-2023-48328 · affects up to 3.37 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery allows Cross Site Request Forgery.This issue affects WordPress Gallery Plugin – NextGEN Gallery: from n/a through 3.37.
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.CVE-2022-38468 · affects up to 3.28 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.
Feb 11, 2020NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file uploadCVE-2013-3684 · fixed in 1.9.13 · reported by MITRECritical 9.8
NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload
NVD recordexchange.xforce.ibmcloud.comexchange.xforce.ibmcloud.com
Nov 26, 2019The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.CVE-2015-9538 · fixed in 2.1.15 · reported by MITREMedium 6.5
The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.
Nov 26, 2019The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, andCVE-2015-9537 · fixed in 2.1.10 · reported by MITREMedium 5.4
The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template.
Aug 27, 2019A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.CVE-2019-14314 · fixed in 3.2.11 · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.
Aug 14, 2019The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.CVE-2016-10889 · fixed in 2.1.57 · reported by MITRECritical 9.8
The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
Apr 30, 2018Image Alt & Title Text: Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS)CVE-2018-1000172 · affects up to 2.2.30 · fixed in 2.2.45 · reported by MITREMedium 4.8
Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in 2.2.45.
Mar 1, 2018In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.CVE-2018-7586 · fixed in 2.2.50 · reported by MITREHigh 7.5
In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.
Sep 12, 2017In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via CVE-2015-9229 · affects 2.1.15 to 2.1.15 · reported by MITREMedium 4.8
In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via the images[1][alttext] parameter.
Sep 12, 2017In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extensionCVE-2015-9228 · reported by MITREHigh 8.8
In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.
Mar 5, 2015SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_CVE-2015-2216 · affects up to 4.07 · reported by MITREHigh 7.5
SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.