BNE Gallery Extended
BNE Gallery Extended has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for BNE Gallery Extended has a vendor fix available, so running the current release closes it.
All of these findings were reported by Peter Thaleikis. BNE Gallery Extended is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2024-11119BNE Gallery Extended <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode
Read the full analysisVulnerability Records
BNE Gallery Extended
Author
Kerry
The default WordPress [gallery] shortcode only displays your images in a traditional column grid. BNE Gallery Extended adds a new option called “display” allowing you to also show the images as a 3D carousel or masonry grid. When adding a new image gallery or editing an existing gallery in your page, a new option will show on the gallery settings to either set the display to 3D Carousel, Masonry, or Default Grid. The default grid is what you have been used to and is the default behavior of WordPress. 3D Carousel adds a jquery rotation to your images and Masonry is similar to the default grid but allows different sizes and stacks them. The Masonry grid will also automatically reduce the number of columns for tablet and mobile screens. To use with the block editor, use a classic editor block, then use the media button on that block’s toolbar to add your legacy media gallery.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C