Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

Information

Software Type Plugin
Software Slug nextgen-gallery (view on wordpress.org)
Software Status Active
Software Author smub
Software Website www.imagely.com
Software Downloads 46,655,839
Software Active Installs 300,000
Software Record Last Updated October 14, 2026

Showing 1-20 of 50 Vulnerabilities

Submit a Vulnerability
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.0 - Unauthenticated Arbitrary File Read
7.5
CVE-2026-94123
Sep 24, 2026
Researcher: Intrudify
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
4.3
CVE-2026-81654
Sep 18, 2026
Researcher: Erwan LR
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
2.7
CVE-2026-81653
Sep 18, 2026
Researcher: Erwan LR
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference
2.7
CVE-2026-81651
Sep 18, 2026
Researcher: Murad Akhmedov
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload
7.2
CVE-2026-81650
Sep 18, 2026
Researcher: Alihan Şahin
NextGEN Gallery <= 4.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference
4.3
CVE-2026-81652
Sep 18, 2026
Researcher: Meher Sudhakar Abbireddi
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.2.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-28141
Aug 3, 2026
Researcher: daroo
Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection
4.9
CVE-2026-9059
May 20, 2026
Researcher: Joshua Martinelle
Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API
4.3
CVE-2026-6566
May 19, 2026
Researcher: Bao Luu Gia Nguyen
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion
8.8
CVE-2026-1463
Mar 17, 2026
Researchers: Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), Waris Damkham
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'
8.8
CVE-2025-13641
Dec 17, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
6.4
CVE-2025-2537
Jul 3, 2025
Researcher: Webbernaut
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library
6.4
CVE-2024-5878
May 19, 2025
Researcher: Webbernaut
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-10545
Feb 4, 2025
Researcher: Erwan LR
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
6.4
CVE-2024-5020
Dec 3, 2024
Researcher: Webbernaut
NextGEN Gallery <= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-6393
Nov 4, 2024
Researcher: Dmitrii Ignatyev
NextGEN Gallery <= 3.59.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-39627
Jul 22, 2024
Researcher: Ibnu Ubaeydillah
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery
4.4
CVE-2024-5442
Jun 22, 2024
Researcher: Krugov Artyom
Nextgen Gallery <= 3.59 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2024-2744
Apr 26, 2024
Researcher: Dmitrii Ignatyev
WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure
5.3
CVE-2024-3097
Apr 5, 2024
Researcher: Peng Zhou
Title Status CVE ID CVSS Researchers Date
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.0 - Unauthenticated Arbitrary File Read Patched CVE-2026-94123 7.5 Intrudify September 24, 2026
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference Patched CVE-2026-81654 4.3 Erwan LR September 18, 2026
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference Patched CVE-2026-81653 2.7 Erwan LR September 18, 2026
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference Patched CVE-2026-81651 2.7 Murad Akhmedov September 18, 2026
NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload Patched CVE-2026-81650 7.2 Alihan Şahin September 18, 2026
NextGEN Gallery <= 4.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference Patched CVE-2026-81652 4.3 Meher Sudhakar Abbireddi September 18, 2026
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.2.3 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-28141 7.2 daroo August 3, 2026
Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection Patched CVE-2026-9059 4.9 Joshua Martinelle May 20, 2026
Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API Patched CVE-2026-6566 4.3 Bao Luu Gia Nguyen May 19, 2026
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion Patched CVE-2026-1463 8.8 Athiwat Tiprasaharn (Jitlada), Itthidej Aramsri (Boeing777), Waris Damkham March 17, 2026
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template' Patched CVE-2025-13641 8.8 Athiwat Tiprasaharn (Jitlada) December 17, 2025
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library Patched CVE-2025-2537 6.4 Webbernaut July 3, 2025
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library Patched CVE-2024-5878 6.4 Webbernaut May 19, 2025
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-10545 4.4 Erwan LR February 4, 2025
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Patched CVE-2024-5020 6.4 Webbernaut December 3, 2024
NextGEN Gallery <= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2024-6393 4.4 Dmitrii Ignatyev November 4, 2024
NextGEN Gallery <= 3.59.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2024-39627 4.4 Ibnu Ubaeydillah July 22, 2024
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery Patched CVE-2024-5442 4.4 Krugov Artyom June 22, 2024
Nextgen Gallery <= 3.59 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2024-2744 4.4 Dmitrii Ignatyev April 26, 2024
WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure Patched CVE-2024-3097 5.3 Peng Zhou April 5, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation