TZ Plus Gallery
TZ Plus Gallery has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.4 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
None of the 2 issues recorded for TZ Plus Gallery have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. TZ Plus Gallery is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.4.21.
CVE-2025-57974TZ PlusGallery <= 1.5.5 - Authenticated (Editor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
TZ Plus Gallery
Author
tuyennv
TZ Plus Gallery display all your albums from social source Facebook, Flickr, Instagram, Google+ and WordPress on your site. You can post your photos every where, every time from your mobile device to Facebook, Flickr, Instagram and Google+. it will auto added on your website. Features Display your albums from online source like Facebook, Instagram, Google + or Flickr to your site’s gallery. Supported WordPress albums. Manage gallery by including/excluding albums, limit the number of pictures to be display in each album. Unlimited gallery display on your site. Display multiple albums in one page or post. Compatible with Tablet, Smart phone. Compatible with Visual Composer plugin. Options choose number of columns. Options choose color style. Options padding of albums or photos. Demo Facebook Fanpage Albums Google+ Albums Instagram Albums Flickr Albums Pro Version
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C