WordPress nextgen-gallery has 25 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-14314 | A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vuln | critical | 9.8 | <3.2.10 | 3.2.10 |
| CVE-2024-3097 | The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability | medium | 5.3 | <3.59.1 | 3.59.1 |
| CVE-2013-3684 | NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload | critical | 9.8 | <1.9.13 | 1.9.13 |
| CVE-2013-0291 | NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability | high | 7.5 | =1.9.10 or =1.9.11 | – |
| CVE-2015-9538 | The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection. | medium | 6.5 | <2.1.15 | 2.1.15 |
| CVE-2015-9228 | In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, | high | 8.8 | =1.5.0 or =1.5.1 or =1.5.2 or =1.5.3 or =1.5.4 or =1.5.5 or =1.6.0 or =1.6.1 or =1.6.2 or =1.7.0 or =1.7.1 or =1.7.2 or =1.7.3 or =1.7.4 or =1.8.0 or =1.8.1 or =1.8.2 or =1.8.3 or =1.8.4 or =1.9.0 or =1.9.1 or =1.9.2 or =1.9.3 or =1.9.5 or =1.9.6 or =1.9.7 or =1.9.8 or =1.9.10 or =1.9.11 or =1.9.12 or =1.9.13 or =2.0 or =2.0.7 or =2.0.11 or =2.0.14 or =2.0.17 or =2.0.21 or =2.0.23 or =2.0.25 or =2.0.27 or =2.0.30 or =2.0.31 or =2.0.33 or =2.0.40 or =2.0.57 or =2.0.58 or =2.0.59 or =2.0.61 or =2.0.63 or =2.0.65 or =2.0.66 or =2.0.66.16 or =2.0.66.17 or =2.0.66.26 or =2.0.66.27 or =2.0.66.29 or =2.0.66.31 or =2.0.66.33 or =2.0.71 or =2.0.74 or =2.0.76 or =2.0.77 or =2.0.78 or =2.0.78.1 or =2.0.79 or =2.1.0 or =2.1.2 or =2.1.7 or =2.1.9 or =2.1.10 | – |
| CVE-2016-6565 | The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a | high | 7.5 | <2.1.57 | 2.1.57 |
| CVE-2018-7586 | In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured. | high | 7.5 | <=2.2.46 | – |
| CVE-2015-1784 | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we | high | 8.8 | <2.0.77.3 | 2.0.77.3 |
| CVE-2016-10889 | The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name. | critical | 9.8 | <2.1.57 | 2.1.57 |
| CVE-2020-35942 | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusi | high | 8.8 | <3.5.0 | 3.5.0 |
| CVE-2015-9537 | The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thum | medium | 5.4 | <2.1.10 | 2.1.10 |
| CVE-2023-3155 | The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter v | high | 7.2 | <3.39 | 3.39 |
| CVE-2015-9229 | In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated | medium | 4.8 | =2.1.15 | – |
| CVE-2023-3279 | The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed | medium | 4.9 | <3.39 | 3.39 |
| CVE-2021-24293 | In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ | medium | 6.1 | <3.1.11 | 3.1.11 |
| CVE-2023-3154 | The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation | high | 7.5 | <3.39 | 3.39 |
| CVE-2020-35943 | A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to by | medium | 6.5 | <3.5.0 | 3.5.0 |
| CVE-2015-1785 | In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we | medium | 6.5 | <2.0.77.3 | 2.0.77.3 |
| CVE-2024-6393 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which co | medium | 4.8 | <3.59.5 | 3.59.5 |
| CVE-2024-2744 | The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.3 | <3.59.1 | 3.59.1 |
| CVE-2024-5442 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could all | medium | 5.9 | <3.59.3 | 3.59.3 |
| CVE-2024-10545 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.9 does not sanitise and escape some of its Image settings, which cou | low | 3.5 | <3.59.9 | 3.59.9 |
| CVE-2023-48328 | Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery allows Cross Site Request Forgery.This | medium | 4.3 | <3.39 | 3.39 |
| CVE-2022-38468 | Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail al | medium | 4.3 | <3.29 | 3.29 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked