WP Easy Gallery – WordPress Gallery Plugin

WP Easy Gallery – WordPress Gallery Plugin has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2013 and 2024; 7 are fixed and 3 remain unpatched as of September 2026. Their average CVSS score is 7.4, and the most serious one scores 9.9 out of 10. Severity breakdown: 2 critical and 4 high. 2014 was the busiest year with 5 disclosures.

The most common weakness is SQL Injection, behind 5 of the records (50%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF).

7 of the records (70%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2024.

5 independent researchers contributed these findings, most of them (2) reported by Lucio Sá.

Strategic Overview

Avg CVSSHigh

7.4/ 10

Patch Coverage70%

Open

Fixed

Get automatic notifications for all WP Easy Gallery – WordPress Gallery Plugin vulnerabilities before they are exploited.

Most severe open issueCVSS 9.9CVE-2024-8436

WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection

Read the full analysis

Vulnerability Records

10 records


2024-09-30 19:33	WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter WP Easy Gallery <= 4.8.5	`CVE-2024-9018`	8.8 High	Peter Thaleikis	No
2024-09-23 18:51	WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection WP Easy Gallery <= 4.8.5	`CVE-2024-8436`	9.9 Critical	Lucio Sá	No
2024-09-23 00:00	WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation WP Easy Gallery <= 4.8.5	`CVE-2024-8437`	4.3 Medium	Lucio Sá	No
2016-01-26 00:00	WP Easy Gallery <= 4.1.4 - Stored Cross-Site Scripting WP Easy Gallery < 4.1.5	`N/A`	6.5 Medium	Rahul Pratap Singh	Yes
2014-08-01 00:00	WP Easy Gallery <= 2.7 - SQL Injection WP Easy Gallery <= 2.7	`N/A`	7.2 High	Anonymous	Yes
2014-08-01 00:00	WP Easy Gallery <= 1.7 - Cross-Site Scripting WP Easy Gallery <= 1.7	`N/A`	6.1 Medium	Heine Pedersen	Yes
2014-08-01 00:00	PrettyPhoto Library (Multiple Plugins and Themes) <= 3.1.4 - DOM Cross-Site Scripting WP Easy Gallery < 4.1.1	`CVE-2013-6837`	6.1 Medium	Anant Shrivastava (anantshri)	Yes
2014-08-01 00:00	WP Easy Gallery <= 2.7 - Cross-Site Request Forgery WP Easy Gallery <= 2.7	`N/A`	8.8 High	Anonymous	Yes
2014-08-01 00:00	WP Easy Gallery <= 2.7 - SQL Injection WP Easy Gallery <= 2.7	`N/A`	7.2 High	Anonymous	Yes
2013-02-18 00:00	WP Easy Gallery <= 2.7 - SQL Injection WP Easy Gallery <= 2.7	`N/A`	9.1 Critical	Anonymous	Yes

Showing 1–10 of 10 reports