WordPress plugin
Picture Gallery – Frontend Uploads & Image Editor security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 6 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium5
- Low0
All Picture Gallery – Frontend Uploads & Image Editor vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.1 | Authenticated (Contributor+) Arbitrary File Deletion ≤1.6.5Update to 1.6.6 | CVE-2026-57696 | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting ≤1.6.3Update to 1.6.4 | CVE-2025-26581 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.5.19Update to 1.5.20 | CVE-2024-13584 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode ≤1.5.22Update to 1.5.23 | CVE-2024-12696 | |
| Medium6.4 | Authenticated (Author+) Stored Cross-Site Scripting ≤1.5.11Update to 1.5.12 | CVE-2024-34759 | |
| Medium5.5 | Cross-Site Scripting ≤1.4.2Update to 1.4.3 | — |
- High8.1Authenticated (Contributor+) Arbitrary File Deletion
≤1.6.5Update to 1.6.6
- Medium6.1Unauthenticated Stored Cross-Site Scripting
≤1.6.3Update to 1.6.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.5.19Update to 1.5.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode
≤1.5.22Update to 1.5.23
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤1.5.11Update to 1.5.12
- Medium5.5Cross-Site Scripting
≤1.4.2Update to 1.4.3
Picture Gallery – Frontend Uploads & Image Editor: common questions
Does Picture Gallery – Frontend Uploads & Image Editor have known vulnerabilities?
Yes. VulnCrest Radar lists 6 known vulnerabilities in Picture Gallery – Frontend Uploads & Image Editor: 1 high, 5 medium. None are known to affect version null.
How do I check which version of Picture Gallery – Frontend Uploads & Image Editor I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Picture Gallery – Frontend Uploads & Image Editor vulnerability?
CVE-2026-57696, published Jul 20, 2026: Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.5 - Authenticated (Contributor+) Arbitrary File Deletion. Severity: High (CVSS 8.1).
Is any Picture Gallery – Frontend Uploads & Image Editor vulnerability listed in CISA KEV?
No. None of the known Picture Gallery – Frontend Uploads & Image Editor vulnerabilities is currently listed in the CISA KEV catalog.