Album and Image Gallery Plus Lightbox

Album and Image Gallery Plus Lightbox has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2023 was the busiest year with 3 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (33%). Other recurring categories include Code Injection, Cross-Site Request Forgery (CSRF).

Every one of the 6 issues recorded for Album and Image Gallery Plus Lightbox has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Album and Image Gallery Plus Lightbox vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-6443

Essentialplugin Plugins (Various Versions) - Injected Backdoor

Read the full analysis

Vulnerability Records

6 records


2026-04-09 00:00	Essentialplugin Plugins (Various Versions) - Injected Backdoor Album and Image Gallery Plus Lightbox 2.1.8	`CVE-2026-6443`	9.8 Critical	Cooties	Yes
2026-02-18 00:00	Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode Album and Image Gallery Plus Lightbox <= 2.1.7	`CVE-2025-13612`	6.4 Medium	Muhammad Yudha - DJ	Yes
2024-06-05 00:00	Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Execution Album and Image Gallery Plus Lightbox <= 2.0	`CVE-2024-4194`	6.5 Medium	stealthcopter	Yes
2023-08-16 00:00	Multiple WPOnlineSupport Plugins <= (Various Versions) - Missing Authorization to Notice Dismissal Album and Image Gallery Plus Lightbox <= 1.7	`CVE-2023-40200`	5.3 Medium	Abdi Pranata	Yes
2023-02-06 00:00	Album and Image Gallery plus Lightbox <= 1.6.2 - Cross-Site Request Forgery Album and Image Gallery Plus Lightbox <= 1.6.2	`N/A`	4.3 Medium	Anonymous	Yes
2023-02-02 00:00	Album and Image Gallery plus Lightbox <= 1.6.2 - Missing Authorization Album and Image Gallery Plus Lightbox <= 1.6.2.	`CVE-2023-25060`	5.3 Medium	Cat	Yes

Showing 1–6 of 6 reports