Is Photo Gallery, Sliders, Proofing and Themes safe?

Every recorded flaw

• Sep 30, 2026Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.CVE-2026-94123 · affects up to 4.5.0 · reported by PatchstackHigh 7.5
• Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not check that a user holds its options capability before saving image sizing settingsCVE-2026-81654 · fixed in 4.5.0 · reported by WPScanLow 3.1
• Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the user acting on an image owns the gallery it belongs toCVE-2026-81653 · fixed in 4.5.0 · reported by WPScanMedium 4.2
• Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the requesting user is entitled to a given image record before returning itCVE-2026-81652 · fixed in 4.5.0 · reported by WPScanLow 2.7
• Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not verify that the user saving a gallery owns itCVE-2026-81651 · fixed in 4.5.0 · reported by WPScanLow 3.1
• Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not correctly validate the extensions of files extracted from an uploaded archiveCVE-2026-81650 · fixed in 4.5.0 · reported by WPScanHigh 7.2
• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.CVE-2026-28141 · affects up to 4.2.3 · reported by PatchstackHigh 7.1
• May 20, 2026Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Insecure Direct Object ReferenceCVE-2026-6566 · affects up to 4.2.0 · reported by WordfenceMedium 4.3
• Mar 18, 2026Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Local File InclusionCVE-2026-1463 · affects up to 4.0.3 · reported by WordfenceHigh 8.8
• Dec 18, 2025Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Local File InclusionCVE-2025-13641 · affects up to 3.59.12 · reported by WordfenceHigh 8.8
• May 20, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in varioCVE-2024-5878 · reported by WordfenceMedium 6.4
• Feb 25, 2025Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Image settingsCVE-2024-10545 · fixed in 3.59.9 · reported by WPScanLow 3.5
• Nov 25, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Images settingsCVE-2024-6393 · fixed in 3.59.5 · reported by WPScanMedium 4.8
• Aug 1, 2024NextGEN Gallery: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39627 · affects up to 3.59.3 · reported by PatchstackMedium 5.9
• Jul 13, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its settingsCVE-2024-5442 · fixed in 3.59.3 · reported by WPScanMedium 5.9
• May 17, 2024NextGEN Gallery: Does not sanitise and escape some of its settingsCVE-2024-2744 · fixed in 3.59.1 · reported by WPScanMedium 4.3
• Apr 9, 2024WordPress Gallery Plugin – NextGEN Gallery: Unauthorized access of dataCVE-2024-3097 · affects up to 3.59 · reported by Wordfence38% oddsMedium 5.3
• Nov 30, 2023WordPress Gallery Plugin – NextGEN Gallery: Cross-Site Request Forgery (CSRF)CVE-2023-48328 · affects up to 3.37 · reported by PatchstackMedium 4.3
• Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.CVE-2022-38468 · affects up to 3.28 · reported by PatchstackMedium 4.3
• Feb 11, 2020NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file uploadCVE-2013-3684 · fixed in 1.9.13 · reported by MITRE19% oddsCritical 9.8
• Nov 26, 2019The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.CVE-2015-9538 · fixed in 2.1.15 · reported by MITRE10% oddsMedium 6.5
• Nov 26, 2019The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, andCVE-2015-9537 · fixed in 2.1.10 · reported by MITRE1.2% oddsMedium 5.4
• Aug 27, 2019A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.CVE-2019-14314 · fixed in 3.2.11 · reported by MITRE43% oddsCritical 9.8
• Aug 14, 2019The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.CVE-2016-10889 · fixed in 2.1.57 · reported by MITRE1.8% oddsCritical 9.8
• Apr 30, 2018Image Alt & Title Text: Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS)CVE-2018-1000172 · affects up to 2.2.30 · fixed in 2.2.45 · reported by MITREMedium 4.8
• Mar 1, 2018In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.CVE-2018-7586 · fixed in 2.2.50 · reported by MITRE2.0% oddsHigh 7.5
• Sep 12, 2017In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated administrators via CVE-2015-9229 · affects 2.1.15 to 2.1.15 · reported by MITREMedium 4.8
• Sep 12, 2017In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extensionCVE-2015-9228 · reported by MITRE3.7% oddsHigh 8.8
• Mar 5, 2015SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_CVE-2015-2216 · affects up to 4.07 · reported by MITRE4.6% oddsHigh 7.5

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.