WordPress plugin
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical3
- High22
- Medium27
- Low2
All Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.1 | Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters ≤4.5.5Update to 4.5.6 | CVE-2026-118191 | |
| High8.8 | Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal ≤4.4.1Update to 4.5.0 | CVE-2026-76010 | |
| High7.5 | Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload ≤4.4.1Update to 4.5.0 | CVE-2026-76012 | |
| High7.5 | Unauthenticated Arbitrary File Read ≤4.5.0Update to 4.5.1 | CVE-2026-94123 | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload ≤4.4.0Update to 4.5.0 | CVE-2026-81650 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.2.3Update to 4.2.4 | CVE-2026-28141 | |
| High8.8 | Authenticated (Author+) Local File Inclusion ≤4.0.4Update to 4.0.5 | CVE-2026-1463 | |
| High8.8 | Authenticated (Contributor+) Local File Inclusion via 'template' ≤3.59.12Update to 4.0.0 | CVE-2025-13641 | |
| High7.2 | Authenticated (Admin+) PHAR Deserialization ≤3.38Update to 3.39 | CVE-2023-3154 | |
| High8.8 | Cross-Site Request Forgery to Arbitrary File Upload ≤3.4.7Update to 3.5.0 | CVE-2020-35943 | |
| High8.8 | Cross-Site Request Forgery ≤3.4.7Update to 3.5.0 | CVE-2020-35942 | |
| Critical9.8 | SQL Injection <3.2.11Update to 3.2.11 | CVE-2019-14314 | |
| High8.8 | Missing Authorization to Arbitrary Options Update <3.1.7Update to 3.1.7 | — | |
| High8.8 | PHP Object Injection ≤3.1.5Update to 3.1.6 | — | |
| High7.5 | Sensitive Information Disclosure ≤2.2.46Update to 2.2.50 | CVE-2018-7586 | |
| High8.3 | SQL Injection ≤2.1.77Update to 2.1.79 | — | |
| High7.5 | Remote File Inclusion ≤2.1.56Update to 2.1.57 | CVE-2016-6565 | |
| Critical9.8 | Authenticated Local File Inclusion & SQL injection ≤2.1.56Update to 2.1.57 | CVE-2016-10889 | |
| High8.8 | Unrestricted File Upload ≤2.1.10Update to 2.1.15 | CVE-2015-9228 | |
| High8.8 | Cross-Site Request Forgery <2.0.77.3Update to 2.0.77.3 | CVE-2015-1784 | |
| High8.8 | Arbitrary File Upload <2.0.77.3Update to 2.0.77.3 | CVE-2015-1785 | |
| High8.8 | Arbitrary File Upload ≤2.0.65Update to 2.0.66 | — | |
| High7.5 | Path Traversal ≤2.0Update to 2.0.7 | — | |
| Critical9.8 | Arbitrary File Upload ≤1.9.12Update to 1.9.13 | CVE-2013-3684 | |
| High7.5 | 1.9.11 - Full Path Disclosure 1.9.10 – 1.9.11Update to 2.0.0 | CVE-2013-0291 |
- High8.1Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters
≤4.5.5Update to 4.5.6
- High8.8Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
≤4.4.1Update to 4.5.0
- High7.5Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload
≤4.4.1Update to 4.5.0
- High7.5Unauthenticated Arbitrary File Read
≤4.5.0Update to 4.5.1
- High7.2Authenticated (Admin+) Arbitrary File Upload
≤4.4.0Update to 4.5.0
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.2.3Update to 4.2.4
- High8.8Authenticated (Author+) Local File Inclusion
≤4.0.4Update to 4.0.5
- High8.8Authenticated (Contributor+) Local File Inclusion via 'template'
≤3.59.12Update to 4.0.0
- High7.2Authenticated (Admin+) PHAR Deserialization
≤3.38Update to 3.39
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
≤3.4.7Update to 3.5.0
- High8.8Cross-Site Request Forgery
≤3.4.7Update to 3.5.0
- Critical9.8SQL Injection
<3.2.11Update to 3.2.11
- High8.8Missing Authorization to Arbitrary Options Update
<3.1.7Update to 3.1.7
- High8.8PHP Object Injection
≤3.1.5Update to 3.1.6
- High7.5Sensitive Information Disclosure
≤2.2.46Update to 2.2.50
- High8.3SQL Injection
≤2.1.77Update to 2.1.79
- High7.5Remote File Inclusion
≤2.1.56Update to 2.1.57
- Critical9.8Authenticated Local File Inclusion & SQL injection
≤2.1.56Update to 2.1.57
- High8.8Unrestricted File Upload
≤2.1.10Update to 2.1.15
- High8.8Cross-Site Request Forgery
<2.0.77.3Update to 2.0.77.3
- High8.8Arbitrary File Upload
<2.0.77.3Update to 2.0.77.3
- High8.8Arbitrary File Upload
≤2.0.65Update to 2.0.66
- High7.5Path Traversal
≤2.0Update to 2.0.7
- Critical9.8Arbitrary File Upload
≤1.9.12Update to 1.9.13
- High7.51.9.11 - Full Path Disclosure
1.9.10 – 1.9.11Update to 2.0.0
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: common questions
Does Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery have known vulnerabilities?
Yes. VulnCrest Radar lists 54 known vulnerabilities in Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: 3 critical, 22 high, 27 medium, 2 low. At least one is not fixed in the latest version.
How do I check which version of Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery vulnerability?
CVE-2026-118191, published Nov 12, 2026: Photo Gallery, Sliders, Proofing and Themes <= 4.5.5 - Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters. Severity: High (CVSS 8.1).
Is any Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery vulnerability listed in CISA KEV?
No. None of the known Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery vulnerabilities is currently listed in the CISA KEV catalog.