Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

1,506 results · page 3 of 31

Sep 12, 2026WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauCVE-2026-90548 · Other software · WWBN · reported by VulnCheckMedium 6.9
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly accessing the endpoint, then fetch the exposed files without authentication.
Product
AVideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Sep 11, 2026WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php CVE-2026-89244 · Other software · WWBN · reported by VulnCheckMedium 5.3
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inject malicious scripts that execute in visitors' browsers when they interact with the Back control.
Product
AVideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Sep 10, 2026Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked directoryCVE-2026-78085 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked directory confinement checks.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record joomshaper.com
Sep 10, 2026Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked CVE-2026-78084 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified file types.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record joomshaper.com
Sep 5, 2026Gallery : FooGallery: Stored Cross-Site ScriptingCVE-2026-85414 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gallery : FooGallery
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Gallery : FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026CatFolders Document Gallery & PDF Library: Does not properly validate a block attribute before using itCVE-2026-84930 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone who views the affected post.
Product
CatFolders Document Gallery & PDF Library
Fixed in
2.0.7
What to do
Update CatFolders Document Gallery & PDF Library to 2.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.CVE-2026-84781 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026Photo Gallery by 10Web: Does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode pageCVE-2026-12865 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).
Product
Photo Gallery by 10Web
Fixed in
1.8.44
What to do
Update Photo Gallery by 10Web to 1.8.44 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Ultimate Before After Image Slider & Gallery: Does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOMCVE-2025-15664 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
Product
Ultimate Before After Image Slider & Gallery
Fixed in
4.7.19
What to do
Update Ultimate Before After Image Slider & Gallery to 4.7.19 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Ultimate Before After Image Slider & Gallery: Does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOMCVE-2025-15663 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.
Product
Ultimate Before After Image Slider & Gallery
Fixed in
4.7.19
What to do
Update Ultimate Before After Image Slider & Gallery to 4.7.19 or newer.
Full record and what to do →NVD record wpscan.com
Sep 1, 2026Photo Gallery by Ays – Responsive Image Gallery: Generic SQL InjectionCVE-2026-76006 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability exists across two execution paths — $wpdb->get_var() in record_count() and $wpdb->get_results() in prepare_items()/get_image_categories() — enabling both blind and UNION-based exfiltration techniques.
Product
Photo Gallery by Ays – Responsive Image Gallery
Affected
up to 6.8.2
What to do
Affects up to 6.8.2. Update Photo Gallery by Ays – Responsive Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 30, 2026A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28.CVE-2026-82483 · Other software · coppermine-gallery · reported by VulDBLow 2
A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file db_input.php of the component Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 1.6.29 will fix this issue. It is recommended to upgrade the affected component.
Product
Coppermine Photo Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 30, 2026A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28.CVE-2026-82482 · Other software · coppermine-gallery · reported by VulDBLow 2
A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component edit_profile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended.
Product
Coppermine Photo Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 29, 2026Catfolders Document Gallery Pro: Does not authorise some of its REST API routesCVE-2026-19430 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.
Product
Catfolders Document Gallery Pro
Fixed in
2.0.7
What to do
Update Catfolders Document Gallery Pro to 2.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026Envira Gallery: Stored Cross-Site ScriptingCVE-2026-3423 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled.
Product
Envira Gallery
Affected
up to 1.12.4
What to do
Affects up to 1.12.4. Update Envira Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2026SOY Gallery contains a cross-site scripting vulnerability.CVE-2026-78238 · Other software · Tsuyoshi Saito · reported by vultures@jpcert.or.jpMedium 4.8
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.
Product
SOY Gallery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp saitodev.co
Aug 26, 2026A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the pageCVE-2026-15366 · Other software · vivo · reported by security@vivo.comLow 2.4
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page
Product
Kids Mode
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vivo.com
Aug 25, 2026Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing.CVE-2026-16645 · Websites & servers · reported by mlhess@drupal.orgCritical 9.1
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Aug 22, 2026Image Photo Gallery Final Tiles Grid: Stored Cross-Site ScriptingCVE-2026-4559 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.12
What to do
Affects up to 3.6.12. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2026AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide GallerCVE-2026-57944 · Other software · WWBN · reported by VulnCheckMedium 5.3
AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator's session cookie to promote arbitrary channels to the front page or delete curated sections without token validation.
Product
AVideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Aug 22, 2026Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS exCVE-2026-66917 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record joomgalleryfriends.net
Aug 22, 2026Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass CVE-2026-66916 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record joomgalleryfriends.net
Aug 21, 2026Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.CVE-2026-76611 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record yootheme.com
Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.CVE-2026-73184 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.
Affected
up to 11.1.2
What to do
Affects up to 11.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.CVE-2026-61986 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.
Affected
up to 30.0.5
What to do
Affects up to 30.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.CVE-2026-74007 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.
Affected
up to 1.16.20
What to do
Affects up to 1.16.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 17, 2026Permission control vulnerability in the Gallery module.CVE-2026-49301 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Aug 16, 2026Gallery by BestWebSoft: SQL InjectionCVE-2026-2497 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `gllr_save_postdata()` function stores unsanitized array keys from `$_POST` directly into post meta, which are later used in SQL queries without prepared statements. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Gallery by BestWebSoft
Affected
up to 4.7.9
What to do
Affects up to 4.7.9. Update Gallery by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026CatFolders Document Gallery & PDF Library: Does not have authorisation checks in some of its REST API endpointsCVE-2026-19717 · WordPress plugins & themes · reported by WPScanHigh 7.5
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.
Product
CatFolders Document Gallery & PDF Library
Fixed in
2.0.7
What to do
Update CatFolders Document Gallery & PDF Library to 2.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 15, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Second-Order SQL InjectionCVE-2026-16586 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
Affected
up to 30.0.7
What to do
Affects up to 30.0.7. Update Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 10, 2026All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`,CVE-2026-19075 · WordPress plugins & themes · reported by WPScanMedium 5
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Meow Gallery: Does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleriesCVE-2026-15386 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
Product
Meow Gallery
Fixed in
5.5.2
What to do
Update Meow Gallery to 5.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.CVE-2026-28141 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider: Stored Cross-Site ScriptingCVE-2026-18400 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, allowing Author-level users to set the malicious delay value via XML-RPC custom_fields when creating an ml-slider post.
Product
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
Affected
up to 3.111.0
What to do
Affects up to 3.111.0. Update Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2026Contest Gallery: Does not route its front-end login through the standard WordPress authentication flowCVE-2026-16055 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.
Product
Contest Gallery
Fixed in
30.0.7
What to do
Update Contest Gallery to 30.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Contest Gallery: Does not perform any capability or nonce check in one of its handlersCVE-2026-16056 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
Product
Contest Gallery
Fixed in
30.0.7
What to do
Update Contest Gallery to 30.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Contest Gallery: Does not perform per-object capability or nonce checks in one of its post-deletion handlersCVE-2026-16057 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
Product
Contest Gallery
Fixed in
30.0.7
What to do
Update Contest Gallery to 30.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026Gallery for Google Photos: Does not properly restrict access to the stored third-party OAuth credentials of the connected accountCVE-2026-15236 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.
Product
Gallery for Google Photos
Fixed in
1.2.1
What to do
Update Gallery for Google Photos to 1.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.CVE-2026-65447 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
Affected
up to 30.0.6
What to do
Affects up to 30.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scCVE-2026-66396 · Other software · siyuan-note · reported by VulnCheckCritical 9.3
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 27, 2026Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.CVE-2026-66448 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.CVE-2026-66434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.
Affected
up to 3.33
What to do
Affects up to 3.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Document Gallery: Does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX actionCVE-2026-12982 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
Product
Document Gallery
Fixed in
5.1.1
What to do
Update Document Gallery to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.CVE-2026-65519 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
Affected
up to 2.7.7.29
What to do
Affects up to 2.7.7.29. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Modula Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65475 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
Product
Modula Image Gallery
Affected
up to 2.14.30
What to do
Affects up to 2.14.30. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.CVE-2026-57696 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.CVE-2026-24628 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.
Affected
up to 1.16.3
What to do
Affects up to 1.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories.CVE-2026-65713 · Websites & servers · reported by security@joomla.orgMedium 6.5
Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record regularlabs.com
Jul 14, 2026Ultimate Before After Image Slider & Gallery: Does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcodeCVE-2025-15665 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.
Product
Ultimate Before After Image Slider & Gallery
Fixed in
4.7.1
What to do
Update Ultimate Before After Image Slider & Gallery to 4.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2026Document Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57695 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through <= 5.1.0.
Product
Document Gallery
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.