Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery — Plugin Vulnerabilities

Medium 6.4

2025-07-03< 3.59.12

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library

EUVD CVE

N/A

2026-03-17< 4.0.5

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion

Wordfence CVE

High 8.8

2025-12-18< 4.0.0

CVE-2025-13641

CVE Wordfence

N/A

2025-07-03< 3.59.12

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library

Wordfence

Medium 6.4

2025-05-20< 3.59.5

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library

EUVD Wordfence CVE

Low 3.5

2025-02-25< 3.59.9

CVE-2024-10545

CVE EUVD Wordfence

Medium 6.4

2024-12-04< 3.59.5

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

CVE Wordfence Patchstack

Medium 4.8

2024-11-25< 3.59.5

CVE-2024-6393

CVE Patchstack Wordfence

Medium 4.8

2024-08-01< 3.59.4

CVE-2024-39627

CVE Patchstack Wordfence

Medium 5.9

2024-07-15< 3.59.3

WordPress NextGEN Gallery Plugin < 3.59.3 is vulnerable to Cross Site Scripting (XSS)

Patchstack CVE Wordfence

Medium 4.3

2024-05-17< 3.59.1

CVE-2024-2744

CVE Patchstack Wordfence

Medium 5.3

2024-04-09< 3.59.1

CVE-2024-3097

CVE Wordfence Patchstack

Medium 4.3

2023-11-30< 3.39

CVE-2023-48328

CVE Patchstack Wordfence

Medium 4.9

2023-10-17< 3.39

WordPress NextGEN Gallery Plugin < 3.39 is vulnerable to Local File Inclusion

Patchstack CVE Wordfence WPScan

High 7.5

2023-10-17< 3.39

WordPress NextGEN Gallery Plugin <= 3.39 is vulnerable to PHP Object Injection

Patchstack CVE Wordfence WPScan

High 7.2

2023-10-17< 3.39

WordPress NextGEN Gallery Plugin < 3.39 is vulnerable to Arbitrary File Deletion

Patchstack CVE Wordfence WPScan

N/A

< 2.0.66

NextGEN Gallery <= 2.0.63 - Arbitrary File Upload

WPScan

N/A

< 2.0.7

NextGEN Gallery 2.0.0 - Directory Traversal

WPScan

N/A

< 1.9.1

NextGEN Gallery <= 1.9.0 - Multiple Cross-Site Scripting (XSS)

WPScan

N/A

< 1.8.4

NextGEN Gallery <= 1.8.3 - XXS & CSRF

WPScan

N/A

< 1.9.8

NextGEN Gallery - swfupload.swf Cross-Site Scripting (XSS)

WPScan

N/A

< 1.7.4

NextGEN Gallery <= 1.7.3 - xml/ajax.php Path Disclosure

WPScan

N/A

< 2.0.0

NextGEN Gallery 1.9.5 - gallerypath Parameter Stored XSS

WPScan

N/A

< 2.1.9

NextGEN Gallery < 2.1.9 - Authenticated Path Traversal

WPScan

N/A

< 2.1.79

NextGEN Gallery < 2.1.79 - Unauthenticated SQL Injection

WPScan

N/A

< 3.1.6

NextGen Gallery <= 3.1.5 - Authenticated PHP Object Injection

WPScan

N/A

2023-07-19< 3.4.7

WordPress NextGEN Gallery Plugin <= 3.3.6 is vulnerable to Cross Site Scripting (XSS)

Patchstack WPScan CVE

Medium 4.3

2023-03-01< 3.29

CVE-2022-38468

CVE Patchstack Wordfence WPScan

N/A

2013-07-19< 1.9.7

CVE-2012-3414

CVE Wordfence Wordfence

N/A

2014-02-18< 2.0.7

NextGen Gallery <= 2.0 - Path Traversal

Wordfence

N/A

2014-05-20< 2.0.66

NextGen Gallery <= 2.0.65 - Arbitrary File Upload

Wordfence

N/A

2015-08-28< 2.1.9

NextGen Gallery <= 2.1.7 - Path Traversal

Wordfence

N/A

2017-02-17< 2.1.79

NextGen Gallery <= 2.1.77 - SQL Injection

Wordfence

N/A

2019-02-04< 3.1.6

NextGen Gallery <= 3.1.5 - PHP Object Injection

Wordfence

N/A

2019-02-25< 3.1.7

Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update

Wordfence

N/A

< 3.1.7

Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update

WPScan

Medium 6.5

2022-07-07< 2.0.77.3

CVE-2015-1785

CVE Wordfence WPScan

High 8.8

2022-07-07< 2.0.77.3

CVE-2015-1784

CVE Wordfence

N/A

2014-02-19< 2.0.1

WordPress NextGEN Gallery Plugin - Directory Traversal

Patchstack

N/A

2013-01-08< 1.9.11

WordPress NextGEN Gallery Plugin - Cross Site Scripting

Patchstack

N/A

2015-05-15< 1.7.4

WordPress NextGEN Gallery Plugin <= 1.7.3 - Full Path Disclosure

Patchstack

N/A

2015-05-15< 1.8.4

WordPress NextGEN Gallery Plugin <= 1.8.3 - Multiple Vulnerabilities

Patchstack

N/A

2015-05-15< 1.9.1

WordPress NextGEN Gallery Plugin <= 1.9.0 - Multiple XSS

Patchstack

N/A

2015-05-15< 2.0.0

WordPress NextGEN Gallery Plugin <= 1.9.5 - Stored XSS

Patchstack

N/A

2015-05-15< 2.0.0

WordPress NextGEN Gallery Plugin <= 1.9.11 - Full Path Disclosure

Patchstack

N/A

2015-05-15< 1.9.8

WordPress NextGEN Gallery Plugin <= 1.9.7 - Cross Site Scripting

Patchstack

N/A

2015-05-15< 2.0.7

WordPress NextGEN Gallery Plugin <= 2.0.0 - Directory Traversal

Patchstack

N/A

2015-05-15< 2.0.66

WordPress NextGEN Gallery Plugin <= 2.0.63 - Arbitrary File Upload

Patchstack

N/A

2015-10-07< 2.1.9

WordPress NextGEN Gallery Plugin <= 2.1.7 - Authenticated Path Traversal

Patchstack

N/A

2016-11-28< 2.1.60

WordPress NextGEN Gallery plugin <= 2.1.59 - Authenticated Remote Code Execution (RCE) Vulnerability

Patchstack

N/A

2019-03-02< 3.1.7

WordPress NextGEN Gallery plugin <= 3.1.6 - Authenticated Option Update vulnerability (Fremius Library security issue)

Patchstack

N/A

2009-09-08≤ 0.96

CVE-2008-7175

CVE Patchstack Wordfence

N/A

2010-04-07< 1.5.2

CVE-2010-1186

CVE Patchstack Wordfence WPScan

Medium 4.8

2017-09-12< 2.1.23

CVE-2015-9229

CVE Wordfence

High 8.8

2017-09-12< 2.1.15

CVE-2015-9228

CVE Wordfence WPScan

High 7.5

2018-03-02< 2.2.50

WordPress NextGEN Gallery plugin <=2.2.46 - Gallery Paths Not Secured

Patchstack Wordfence CVE WPScan

Medium 4.8

2018-04-30< 2.2.45

CVE-2018-1000172

CVE Wordfence WPScan

High 7.5

2025-10-03< 2.1.57

CVE-2016-6565

EUVD CVE Wordfence

Critical 9.8

2019-08-14< 2.1.57

CVE-2016-10889

CVE Wordfence WPScan

Critical 9.8

2019-08-27< 3.2.11

CVE-2019-14314

CVE Patchstack Wordfence WPScan

Medium 5.4

2019-11-26< 2.1.10

CVE-2015-9537

CVE Wordfence WPScan

Medium 6.5

2019-11-26< 2.1.15

CVE-2015-9538

CVE Wordfence WPScan

Critical 9.8

2020-02-11< 1.9.13

CVE-2013-3684

CVE Wordfence Patchstack WPScan

High 7.5

2020-01-30≥ 1.9.10 and ≤ 1.9.11

CVE-2013-0291

CVE Patchstack Wordfence WPScan

Medium 6.5

2021-02-09< 3.5.0

CVE-2020-35943

CVE Patchstack Wordfence WPScan

High 8.8

2021-02-09< 3.5.0

CVE-2020-35942

CVE Patchstack Wordfence WPScan