Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · envira-gallery-lite
Envira Gallery
19 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 11, 2026Envira Gallery: Does not verify that a user is authorized to read a gallery before rendering itCVE-2026-104684 · fixed in 1.16.2 · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
Oct 11, 2026Envira Gallery: Does not correctly check authorization on its gallery-conversion featureCVE-2026-104682 · fixed in 1.16.2 · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
Oct 11, 2026Envira Gallery: Does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to viewCVE-2026-104681 · fixed in 1.16.2 · reported by WPScanLow 2.7
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
Oct 11, 2026Envira Gallery: Does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1CVE-2026-104680 · fixed in 1.16.2 · reported by WPScanHigh 7.2
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery WordPress plugin before 1.16.2 into the network-shared Envira Gallery WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.
Oct 9, 2026its gallery conversion REST endpoint that: Envira Gallery Lite before 1.16.2 contains a missing authorizationCVE-2026-104079 · fixed in 1.16.2 · reported by VulnCheckMedium 5.3
Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.
Oct 7, 2026Envira Gallery: Does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attributeCVE-2026-104653 · fixed in 1.16.1 · reported by WPScanMedium 6.8
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
Oct 7, 2026Envira Gallery: Does not sanitise and escape a gallery item identifier before outputting it in an image tag attributeCVE-2026-104652 · fixed in 1.16.1 · reported by WPScanMedium 6.8
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
Aug 28, 2026Envira Gallery: Stored Cross-Site ScriptingCVE-2026-3423 · affects up to 1.12.4 · reported by WordfenceMedium 6.4
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.CVE-2026-54190 · affects up to 1.12.5 · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.
May 14, 2026Envira Gallery Lite: Stored Cross-Site ScriptingCVE-2026-5361 · affects up to 1.12.4 · reported by WordfenceMedium 6.4
The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due to insufficient input sanitization in the update_gallery_data() function and improper output escaping in the gallery_init() function. The sanitize_config_values() function only sanitizes the justified_gallery_theme and justified_row_height parameters, but does not sanitize the arrows parameter. When the arrows value is output in the inline JavaScript configuration, it uses esc_attr() which is designed for HTML attribute contexts, not JavaScript contexts, allowing JavaScript expression injection. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 4, 2026Envira Gallery for: Stored Cross-Site ScriptingCVE-2026-1236 · affects up to 1.12.3 · reported by WordfenceMedium 6.4
The Envira Gallery for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'justified_gallery_theme' parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 13, 2025Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2025-12377 · affects up to 1.12.0 · reported by WordfenceMedium 4.3
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-level access and above, to perform multiple actions, such as removing images from arbitrary galleries. The vulnerability was partially patched in version 1.12.0.
Nov 8, 2025Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2025-11448 · affects up to 1.11.0 · reported by WordfenceMedium 4.3
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries.
Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-43925 · affects up to 1.8.14 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.14.
Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-37095 · affects up to 1.8.7.3 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.7.3.
Jan 11, 2024Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2023-6742 · affects up to 1.8.7.1 · reported by WordfenceMedium 4.3
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'envira_gallery_insert_images' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify galleries on other users' posts.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2022Gallery Plugin for: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2190 · fixed in 1.8.4.7 · reported by WPScanMedium 6.1
The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Mar 18, 2021Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadatCVE-2021-24126 · fixed in 1.8.3.3 · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata (namely title) before outputting them in the generated gallery, which could lead to privilege escalation.
Feb 25, 2020A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress.CVE-2020-9334 · affects up to 1.7.6 · reported by MITREMedium 5.4
A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.