Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

Уязвимости

• CVE-2019-14314без авторизации

  A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.

  Критич. 9.8

• CVE-2016-10889без авторизации

  The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.

  Критич. 9.8

• CVE-2023-48328без авторизации · нужен клик≤ 3.37

  WordPress NextGEN Gallery Plugin <= 3.37 is vulnerable to Cross Site Request Forgery (CSRF)

  Высокий 8.8

• CVE-2015-9228нужен вход

  In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter,

  Высокий 8.8

• CVE-2026-1463автор+≤ 4.0.4

  Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion

  Высокий 8.8

• CVE-2025-13641участник+≤ 3.59.12

  Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'

  Высокий 8.8

• CVE-2026-94123без авторизации≤ 4.5.0

  WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability

  Высокий 7.5

• CVE-2018-7586без авторизации

  In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.

  Высокий 7.5

• CVE-2026-28141без авторизации · нужен клик≤ 4.2.3

  WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2015-9538нужен вход

  The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.

  Средний 6.5

• CVE-2025-2537участник+

  Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library

  Средний 6.4

• CVE-2024-5878участник+

  Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library

  Средний 6.4

• CVE-2015-9537нужен вход

  The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thum

  Средний 5.4

• CVE-2024-3097без авторизации≤ 3.59

  WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure

  Средний 5.3

• CVE-2024-39627высокие права≤ 3.59.3

  WordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 3.59.3 - Cross Site Scripting (XSS) vulnerability

  Средний 4.8

• CVE-2018-1000172высокие права

  Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text.

  Средний 4.8

• CVE-2022-38468без авторизации · нужен клик≤ 3.28

  WordPress NextGEN Gallery Plugin <= 3.28 is vulnerable to Cross Site Request Forgery (CSRF)

  Средний 4.3

• CVE-2026-6566подписчик+≤ 4.2.0

  Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API

  Средний 4.3

• CVE-2010-1186

  Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attacke

  Средний 4.3