Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

Explore Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery vulnerabilities across all versions. Currently tracking 42 known vulnerabilities, including severity, impact, and patch status.

01234567891023.04.2007Today07.06.20084.4NextGEN Gallery Plugin <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 07.06.200806.04.20106.1WordPress Gallery Plugin – NextGEN Gallery <= 1.5.1 - Cross-Site Scripting CVSS 6.1 · 06.04.201014.06.20126.1NextGen Gallery <= 1.9.7 - Cross-Site Scripting CVSS 6.1 · 14.06.201209.11.20126.1SWFUpload <= 2.2.0.1 - Cross-Site Scripting CVSS 6.1 · 09.11.201214.02.20137.5WordPress Gallery Plugin – NextGEN Gallery 1.9.10 - 1.9.11 - Full Path Disclosure CVSS 7.5 · 14.02.201313.06.20139.8WordPress Gallery Plugin – NextGEN Gallery <= 1.9.12 - Arbitrary File Upload CVSS 9.8 · 13.06.201318.02.20147.5NextGen Gallery <= 2.0 - Path Traversal CVSS 7.5 · 18.02.201420.05.20148.8NextGen Gallery <= 2.0.65 - Arbitrary File Upload CVSS 8.8 · 20.05.201425.03.20158.8WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Arbitrary File Upload CVSS 8.8 · 25.03.20158.8WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Cross-Site Request Forgery CVSS 8.8 · 25.03.201528.08.20156.5NextGen Gallery <= 2.1.7 - Path Traversal CVSS 6.5 · 28.08.20156.5NextGen Gallery <= 2.1.10 - Local File Inclusion CVSS 6.5 · 28.08.201531.08.20156.4NextGen Gallery <= 2.1.9 - Cross-Site Scripting CVSS 6.4 · 31.08.201514.09.20155.5WordPress Gallery Plugin – NextGEN Gallery <= 2.1.15 - Authenticated (Admin+) Cross-Site Scripting CVSS 5.5 · 14.09.201523.12.20158.8NextGen Gallery <= 2.1.10 - Unrestricted File Upload CVSS 8.8 · 23.12.201515.11.20167.5NextGen Gallery <= 2.1.56 - Remote File Inclusion CVSS 7.5 · 15.11.20169.8NextGEN Gallery <= 2.1.56 - Authenticated Local File Inclusion & SQL injection CVSS 9.8 · 15.11.201617.02.20178.3NextGen Gallery <= 2.1.77 - SQL Injection CVSS 8.3 · 17.02.201714.02.20184.8NextGEN Gallery <= 2.2.44 - Cross-Site Scripting via image alt and title text CVSS 4.8 · 14.02.201802.03.20187.5WordPress Gallery Plugin – NextGEN Gallery <= 2.2.46 - Sensitive Information Disclosure CVSS 7.5 · 02.03.201804.02.20198.8NextGen Gallery <= 3.1.5 - PHP Object Injection CVSS 8.8 · 04.02.201925.02.20198.8Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update CVSS 8.8 · 25.02.201927.08.20199.8NextGEN Gallery <= 3.2.10 - SQL Injection CVSS 9.8 · 27.08.201917.12.20208.8WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery to Arbitrary File Upload CVSS 8.8 · 17.12.20208.8WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery CVSS 8.8 · 17.12.202014.02.20234.3NextGEN Gallery <= 3.28 - Cross-Site Request Forgery leading to Post Thumbnail Change CVSS 4.3 · 14.02.202325.09.20237.2WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) PHAR Deserialization CVSS 7.2 · 25.09.20236.5NextGEN Gallery <= 3.37 - Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit CVSS 6.5 · 25.09.20234.9WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) Local File Inclusion CVSS 4.9 · 25.09.202323.11.20234.3NextGEN Gallery <= 3.37 - Cross-Site Request Forgery CVSS 4.3 · 23.11.202305.04.20245.3WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure CVSS 5.3 · 05.04.202426.04.20244.4Nextgen Gallery <= 3.59 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 26.04.202422.06.20244.4Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery CVSS 4.4 · 22.06.202422.07.20244.4NextGEN Gallery <= 3.59.3 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 22.07.202404.11.20244.4NextGEN Gallery <= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 04.11.202403.12.20246.4Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library CVSS 6.4 · 03.12.202404.02.20254.4Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 04.02.202519.05.20256.4Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library CVSS 6.4 · 19.05.202503.07.20256.4Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library CVSS 6.4 · 03.07.202517.12.20258.8Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template' CVSS 8.8 · 17.12.202517.03.20268.8Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion CVSS 8.8 · 17.03.202619.05.20264.3Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API CVSS 4.3 · 19.05.2026

Strategic Overview

Avg CVSSMedium
6.8/ 10
Patch Coverage100%
Open

0

Fixed

42

Get automatic notifications for all Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery vulnerabilities before they are exploited.

Vulnerability Records

42 records
2026-05-19 17:01CVE-2026-6566
4.3
Medium
Bao Luu Gia NguyenYes
2026-03-17 00:00CVE-2026-1463
8.8
High
Athiwat Tiprasaharn (Jitlada)Yes
2025-12-17 00:00CVE-2025-13641
8.8
High
Athiwat Tiprasaharn (Jitlada)Yes
2025-07-03 00:20CVE-2025-2537
6.4
Medium
WebbernautYes
2025-05-19 00:00CVE-2024-5878
6.4
Medium
WebbernautYes
2025-02-04 00:00CVE-2024-10545
4.4
Medium
Erwan LRYes
2024-12-03 00:00CVE-2024-5020
6.4
Medium
WebbernautYes
2024-11-04 00:00CVE-2024-6393
4.4
Medium
Dmitrii IgnatyevYes
2024-07-22 00:00CVE-2024-39627
4.4
Medium
Ibnu UbaeydillahYes
2024-06-22 00:00CVE-2024-5442
4.4
Medium
Krugov ArtyomYes
Showing 1–10 of 42 reports
Photo Gallery, Sliders, Proofing and Themes &#8211; NextGEN Gallery banner
Latestv4.2.3

Photo Gallery, Sliders, Proofing and Themes &#8211; NextGEN Gallery

Syed Balkhi

Author

Syed Balkhi

4.3(4,338)
86/100
Last Updated
2026-06-30 (29d ago)
Active Installs
300,000+
Downloads
45,417,976
Requires WP
5.5.4+
Requires PHP
7.0+
Tested up to
WP 7.0.2
Created
2007-04-23 (20y ago)

WordPress Gallery Plugin NextGEN Gallery has been the industry’s standard WordPress gallery plugin since 2007 and continues to receive over 1.5 million new downloads per year. It’s easy to use for simple photo galleries, but powerful enough for the most demanding photographers, visual artists, and imaging professionals who need a comprehensive photo gallery solution. NextGEN Gallery offers complete WordPress gallery management with the ability to batch upload photos, import metadata, easily add, delete, rearrange photos and create an unlimited number of galleries. You can even simply provide a zip file or choose a folder to upload photos. But our photo gallery plugin doesn’t stop there! NextGEN Pro This plugin is the lite version of the NextGEN Gallery plugin, which offers all the gallery features you’ll need like photo albums, lightboxes, backups, search, sharing, filtering, print fulfillment, eCommerce, animations, and tons more. Click here to purchase the best photo gallery plugin for WordPress now! The free version of NextGEN gallery provides three main gallery styles (slideshow, thumbnail, and imagebrowser galleries) and two album styles (compact and extended), all of which come with a wide array of options for controlling size, style, timing, transitions, controls, lightbox effects, and more. Learn more about NextGEN WordPress Gallery Plugin features. The best gets better with full support for the Gutenberg block editor. Now you can add a photo gallery or album anywhere on your site, with a page builder type feel directly in the WordPress editor. We truly make creating, building, and editing galleries easy. Feature List We’ve built NextGEN Gallery to be extremely powerful and full of features. Albums Organize multiple photo galleries into albums for easy sorting and viewing Tags Group multiple images together with tags, with easy-to-update renaming and management eCommerce Sell images from your photo gallery, or sell entire galleries with our built in payment processing. Works with Stripe and PayPal. Slideshows Make your galleries automatically rotate through a series of images Themes Access 84+ different types of themes to showcase your galleries Animations Create visual interest with 25+ different types of animations for each gallery Watermarks Protect your work with image and text-based watermarks. Capabilities Customize who can read, edit, and publish galleries with refined permsisions controls Image Proofing Let your customers choose which photos to purchase and improve your workflow. Print Fulfillment Sell your photos and ship prints directly to customers with automated print lab fulfillment and zero commissions Auto Tax calculations Automatically calculate sales tax when required for your customers. Coupons Offer discounts and incentives to increase your gallery sales Lightroom Integration Automatically sync and create photo galleries from Adobe Lightroom into NextGEN Gallery without any need to update your website. Social Sharing Create viral social media opportunities when your images are optimized for Open Graph and X Image Commenting * Add deep engagement to your images within the lightbox to increase gallery engagement Deep Linking Link directly to a specific image from one of your galleries Frontend Search * Add powerful filtering for your gallery based on tags Hover Captions * Add social sharing, tiles, and descriptions for each image Digital Downloads Offer digital downloads of your images for free, or chage for them with our eCommerce gallery plugin Right Click Disable prevent images in your galleries from being downloaded with easy right click and drag/drop protection. Customization * We’ve built in lots of individual customizations for each of our features so that you can make NextGEN Gallery perfect for you As you can see, we’ve built a photo gallery plugin that is suitable for everyone! Want a specific or missing feature? Just let us know. NEXTGEN GALLERY DEMOS *Basic Thumbnail Gallery *Basic Slideshow Gallery *Basic Imagebrowser Gallery *Basic Compact Album *Basic List Album NEXTGEN PRO DEMOS *Photo Print Sales *Photo Proofing *Digital Downloads *Pro Mosaic Gallery *Pro Masonry Gallery *Pro Tile Gallery *Pro Filmstrip Gallery *Pro Lightbox About Imagely NextGEN Gallery is a WordPress gallery plugin maintained by Imagely. We’re the WordPress photography experts. In addition to NextGEN Gallery, NextGEN Plus, and NextGEN Pro, we also make WordPress themes for photographers, providing beautiful turnkey websites for photographers. Learn more or connect with us: *Imagely Website *WordPress Themes for Photographers *Turnkey Photography Sites *NextGEN Gallery Documentation Credits Copyright: Imagely 2016-2024 Shortcodes NextGEN Gallery offers an easy-to-use Insert Gallery Window, which means you never need to work with shortcodes again when inserting and manageing galleries – if you would prefer not too. If you do want to work with shortcodes, there is a powerful shortcode system as you’d expect of a popular WordPress gallery plugin. Learn About NextGEN Gallery Shortcodes. For more information, feel free to visit the official website for the NextGEN Gallery WordPress Gallery Plugin.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C