Picture Gallery – Frontend Image Uploads, AJAX Photo List

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Picture Gallery – Frontend Image Uploads, AJAX Photo List

Information

Software Type Plugin
Software Slug picture-gallery (view on wordpress.org)
Software Status Active
Software Author videowhisper
Software Website videochat-scripts.com
Software Downloads 28,802
Software Active Installs 400
Software Record Last Updated July 13, 2026

5 Vulnerabilities

Submit a Vulnerability
Picture Gallery <= 1.6.3 - Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2025-26581
Mar 12, 2025
Researcher: João Pedro Soares de Alcântara
Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-13584
Jan 21, 2025
Researcher: Peter Thaleikis
Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode
6.4
CVE-2024-12696
Jan 17, 2025
Researcher: SOPROBRO
Picture Gallery <= 1.5.11 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2024-34759
May 14, 2024
Researcher: Rayhan Ramdhany Hanaputra
Picture Gallery – Frontend Image Uploads, AJAX Photo List < 1.4.3 - Cross-Site Scripting
5.5
CVE ID Unknown
Aug 10, 2021
Researcher: Aryan Chehreghani
Title Status CVE ID CVSS Researchers Date
Picture Gallery <= 1.6.3 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2025-26581 6.1 João Pedro Soares de Alcântara March 12, 2025
Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-13584 6.4 Peter Thaleikis January 21, 2025
Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode Patched CVE-2024-12696 6.4 SOPROBRO January 17, 2025
Picture Gallery <= 1.5.11 - Authenticated (Author+) Stored Cross-Site Scripting Patched CVE-2024-34759 6.4 Rayhan Ramdhany Hanaputra May 14, 2024
Picture Gallery – Frontend Image Uploads, AJAX Photo List < 1.4.3 - Cross-Site Scripting Patched 5.5 Aryan Chehreghani August 10, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation