NextGEN Gallery – Create an Amazing Photo Gallery in Seconds

Software Type	Plugin
Software Slug	nextgen-gallery (view on wordpress.org)
Software Status	Active
Software Author	smub
Software Website	www.imagely.com
Software Downloads	40,367,627
Software Active Installs	500,000
Software Record Last Updated	May 9, 2024

Showing 1-20 of 31 Vulnerabilities

WordPress Gallery Plugin – NextGEN Gallery <= 1.5.1 - Cross-Site Scripting

6.1

CVE-2010-1186

Apr 6, 2010

Researcher: Core Security Technologies

NextGen Gallery <= 1.9.7 - Cross-Site Scripting

6.1

CVE-2012-3414

Jun 14, 2012

Researchers:

SWFUpload <= 2.2.0.1 - Cross-Site Scripting

6.1

CVE-2012-3414

Nov 9, 2012

Researchers: Neal Poole, Nathan Partlan

WordPress Gallery Plugin – NextGEN Gallery 1.9.10 - 1.9.11 - Full Path Disclosure

7.5

CVE-2013-0291

Feb 14, 2013

Researcher: Henrique Montenegro

WordPress Gallery Plugin – NextGEN Gallery <= 1.9.12 - Arbitrary File Upload

9.8

CVE-2013-3684

Jun 13, 2013

Researcher: Marcos Agüero

NextGen Gallery <= 2.0 - Path Traversal

7.5

CVE ID Unknown

Feb 18, 2014

Researcher: Mallory Adams

NextGen Gallery <= 2.0.65 - Arbitrary File Upload

8.8

CVE ID Unknown

May 20, 2014

Researcher: SANTHO

WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Cross-Site Request Forgery

8.8

CVE-2015-1784

Mar 25, 2015

Researcher: Louie Augarde

WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Arbitrary File Upload

8.8

CVE-2015-1785

Mar 25, 2015

Researcher: Louie Augarde

NextGen Gallery <= 2.1.10 - Local File Inclusion

6.5

CVE-2015-9538

Aug 28, 2015

Researcher: Sathish Kumar

NextGen Gallery <= 2.1.7 - Path Traversal

6.5

CVE ID Unknown

Aug 28, 2015

Researcher: Sathish Kumar

NextGen Gallery <= 2.1.9 - Cross-Site Scripting

6.4

CVE-2015-9537

Aug 31, 2015

Researcher: Sathish Kumar

WordPress Gallery Plugin – NextGEN Gallery <= 2.1.15 - Authenticated (Admin+) Cross-Site Scripting

5.5

CVE-2015-9229

Sep 14, 2015

Researcher: cybersecurityworks

NextGen Gallery <= 2.1.10 - Unrestricted File Upload

8.8

CVE-2015-9228

Dec 23, 2015

Researcher: Sathish Kumar

NextGen Gallery <= 2.1.56 - Remote File Inclusion

7.5

CVE-2016-6565

Nov 15, 2016

Researcher: Mukhammad Khalilov

NextGEN Gallery <= 2.1.56 - Authenticated Local File Inclusion & SQL injection

9.8

CVE-2016-10889

Nov 15, 2016

Researchers:

NextGen Gallery <= 2.1.77 - SQL Injection

8.3

CVE ID Unknown

Feb 17, 2017

Researcher: Slavco Mihajloski

NextGEN Gallery <= 2.2.44 - Cross-Site Scripting via image alt and title text

4.8

CVE-2018-1000172

Feb 14, 2018

Researcher: Zhouyuan Yang

WordPress Gallery Plugin – NextGEN Gallery <= 2.2.46 - Sensitive Information Disclosure

7.5

CVE-2018-7586

Mar 2, 2018

Researchers:

NextGen Gallery <= 3.1.5 - PHP Object Injection

8.8

CVE ID Unknown

Feb 4, 2019

Researcher: Slavco Mihajloski

Title	CVE ID	CVSS	Researchers	Date
WordPress Gallery Plugin – NextGEN Gallery <= 1.5.1 - Cross-Site Scripting	CVE-2010-1186	6.1	Core Security Technologies	April 6, 2010
NextGen Gallery <= 1.9.7 - Cross-Site Scripting	CVE-2012-3414	6.1		June 14, 2012
SWFUpload <= 2.2.0.1 - Cross-Site Scripting	CVE-2012-3414	6.1	Neal Poole, Nathan Partlan	November 9, 2012
WordPress Gallery Plugin – NextGEN Gallery 1.9.10 - 1.9.11 - Full Path Disclosure	CVE-2013-0291	7.5	Henrique Montenegro	February 14, 2013
WordPress Gallery Plugin – NextGEN Gallery <= 1.9.12 - Arbitrary File Upload	CVE-2013-3684	9.8	Marcos Agüero	June 13, 2013
NextGen Gallery <= 2.0 - Path Traversal		7.5	Mallory Adams	February 18, 2014
NextGen Gallery <= 2.0.65 - Arbitrary File Upload		8.8	SANTHO	May 20, 2014
WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Cross-Site Request Forgery	CVE-2015-1784	8.8	Louie Augarde	March 25, 2015
WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Arbitrary File Upload	CVE-2015-1785	8.8	Louie Augarde	March 25, 2015
NextGen Gallery <= 2.1.10 - Local File Inclusion	CVE-2015-9538	6.5	Sathish Kumar	August 28, 2015
NextGen Gallery <= 2.1.7 - Path Traversal		6.5	Sathish Kumar	August 28, 2015
NextGen Gallery <= 2.1.9 - Cross-Site Scripting	CVE-2015-9537	6.4	Sathish Kumar	August 31, 2015
WordPress Gallery Plugin – NextGEN Gallery <= 2.1.15 - Authenticated (Admin+) Cross-Site Scripting	CVE-2015-9229	5.5	cybersecurityworks	September 14, 2015
NextGen Gallery <= 2.1.10 - Unrestricted File Upload	CVE-2015-9228	8.8	Sathish Kumar	December 23, 2015
NextGen Gallery <= 2.1.56 - Remote File Inclusion	CVE-2016-6565	7.5	Mukhammad Khalilov	November 15, 2016
NextGEN Gallery <= 2.1.56 - Authenticated Local File Inclusion & SQL injection	CVE-2016-10889	9.8		November 15, 2016
NextGen Gallery <= 2.1.77 - SQL Injection		8.3	Slavco Mihajloski	February 17, 2017
NextGEN Gallery <= 2.2.44 - Cross-Site Scripting via image alt and title text	CVE-2018-1000172	4.8	Zhouyuan Yang	February 14, 2018
WordPress Gallery Plugin – NextGEN Gallery <= 2.2.46 - Sensitive Information Disclosure	CVE-2018-7586	7.5		March 2, 2018
NextGen Gallery <= 3.1.5 - PHP Object Injection		8.8	Slavco Mihajloski	February 4, 2019

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation