Picture Gallery – Frontend Uploads & Image Editor
Picture Gallery – Frontend Uploads & Image Editor has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 6 are fixed as of October 2026. Their average CVSS score is 6.5, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 5 of the records (83%). Other recurring categories include Path Traversal.
Every one of the 6 issues recorded for Picture Gallery – Frontend Uploads & Image Editor has a vendor fix available, so running the current release closes all known holes.
6 independent researchers contributed these findings, one record each. Picture Gallery – Frontend Uploads & Image Editor is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-57696Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.5 - Authenticated (Contributor+) Arbitrary File Deletion
Read the full analysisVulnerability Records

Picture Gallery – Frontend Uploads & Image Editor
Author
videowhisper
Turn visitor photos into a gallery worth exploring. Picture Gallery adds picture posts, searchable image listings, frontend uploads and a My Pictures workspace to WordPress. Use it for creator portfolios, community photo submissions, member galleries, event pictures or visual collections alongside your videos and live channels. Visitors can browse a compact grid, open pictures in a full-screen PhotoSwipe viewer, or read more in picture cards. Contributors can upload and edit their own pictures from the frontend. You control who can upload, who can publish directly and which submissions need review. Start with community uploads or a portfolio from your existing Media Library using the setup guide. Keep original attachments and copy their titles, captions and alternative text into independent Picture posts. Repeat imports safely without overwriting later Picture edits. The gallery, viewer and image editor are included free. Image processing runs on your WordPress hosting using its available image editor; no external editor account or image-processing subscription is required. Make your pictures easy to discover Native gallery block: add a gallery in the WordPress editor, select existing Pictures or import Media Library images, and reorder your selection without writing a shortcode. Three distinct layouts: Styled Tiles for a compact traditional gallery, a dense Responsive grid and Picture cards with titles and descriptions. Menu or dropdown filters: let visitors search by name or tags, select a category and sort pictures. Each listing can use its own layout and filters. PhotoSwipe browsing: zoom, swipe and move through authorized nearby pictures, with larger previous/next previews, an optional thumbnail strip and a visible button to open the picture post. Clean presentation: thumbnail-aware sizing, small resolution labels, subtle hover effects and matching management buttons. FansPaysite light/dark mode and palette changes apply without reloading. Useful without JavaScript: grid/cards and PhotoSwipe-enabled tiles start with real images, picture-post links and page navigation; enhancement adds AJAX filtering and the viewer. Let contributors manage their pictures Frontend uploads: select multiple JPG, PNG or GIF pictures, or drag and drop them onto the member uploader. Compatible mobile browsers can choose camera or photo-library images. My Pictures: give each logged-in contributor a personal workspace for images, titles, captions, descriptions, alternative text and existing categories/tags. Review submissions before changing public content. Simple image tools: choose Crop, Resize, Rotate or Flip, then expand just that tool’s controls. Preview changes, undo/redo and save without opening the dashboard. JPEG and PNG editing is supported. Review and restore: edits can await approval while the existing public image remains available. Restore original composition creates a fresh generation; the original and normalized master are retained. Guest contributions: optional guest upload form with moderation, rate limits, notification email and optional Google reCAPTCHA v3. Practical tools for site owners A clearer first setup: choose community uploads or a Media Library portfolio, preview the three layouts and find your gallery pages quickly. Reuse existing images: import selected Media Library images with optional initial titles, captions and alternative text, while retaining original files and later Picture edits. Optional AI-agent inspection: on WordPress 6.9+, let authenticated tools find authorized pictures missing alternative text or captions and inspect their current details. Read-only abilities cannot change content or files; no AI service is bundled or required. Eight included interface languages: Spanish (es_ES), Brazilian Portuguese (pt_BR), French (fr_FR), Dutch (nl_NL), German (de_DE), Arabic (ar), Italian (it_IT) and Romanian (ro_RO), including the block editor and frontend tools. Picture posts with gallery taxonomy, categories, tags and WordPress Media Library integration. Role-based upload/publish rules and gallery access settings. EXIF orientation correction and WordPress image-editor thumbnail generation, with bounded processing checks. Automatic queued refresh when displayed thumbnails no longer match configured sizes, plus a bounded administrator thumbnail tool. On-demand import of existing Picture Gallery media relationships when pictures are listed, viewed or edited; existing posts, authors and URLs are preserved. Durable upload identities, upload journal inspection and pending-only recovery after interrupted requests. Image Edit Journals for inspected save recovery and explicit cleanup of proven unused edit files after a retention period. Conservative shared-media checks and retention by default, including after deactivation or uninstall. Extend your community Optional integrations add more ways to use your gallery: MicroPayments / FansPaysite adds content monetization and frontend content management. Picture Gallery checks supported membership and purchase entitlements before including images in its modern galleries/viewer. Rate Star Review adds star ratings and provider-controlled likes/votes to all three listing layouts. Video Share VOD and Broadcast Live Video complement pictures with recorded or live video. Paid VideoChat integrates pictures with performer profiles. These integrations are optional. Publicly reachable image files are not protected downloads: restricting gallery access does not make an existing public file URL private. Picture Gallery is provided by VideoWhisper. For optional installation help, custom development or suitable hosting, contact VideoWhisper. No service purchase is required for the included gallery and editing features. If the plugin helps your website, share your experience.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C