Extension WordPress
Vulnérabilités Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Cette page rassemble les failles publiées pour Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
42 fiches
Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 – Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion…
*-4.2.0
4.2.1
19/05/2026
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 – Authenticated (Author+) Local File Inclusion
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.3 via the 'template' parameter in gallery shortcodes. This makes it possible…
*-4.0.4
4.0.5
17/03/2026
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 – Authenticated (Contributor+) Local File Inclusion via 'template'
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter. This is due to insufficient path…
*-3.59.12
4.0.0
17/12/2025
Multiple Plugins <= (Various Versions) – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…
*-3.59.11
3.59.12
03/07/2025
Multiple Plugins <= (Various Versions) – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…
*-3.59.4
3.59.5
19/05/2025
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.8 – Authenticated (Admin+) Stored Cross-Site Scripting
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.59.8 due to insufficient input sanitization and output escaping.…
*-3.59.8
3.59.9
04/02/2025
Multiple Plugins <= (Various Versions) – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes…
*-3.59.4
3.59.5
03/12/2024
NextGEN Gallery <= 3.39.4 – Authenticated (Administrator+) Stored Cross-Site Scripting
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.39.4 due to insufficient input sanitization and output escaping.…
*-3.39.4
3.39.5
04/11/2024
NextGEN Gallery <= 3.59.3 – Authenticated (Administrator+) Stored Cross-Site Scripting
The NextGEN Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.59.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and…
*-3.59.3
3.59.4
22/07/2024
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.2 – Authenticated (Admin+) Stored Cross-Site Scripting via Gallery
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gallery settings in all versions up to, and including, 3.59.2 due to insufficient input sanitization and output escaping.…
*-3.59.2
3.59.3
22/06/2024
Nextgen Gallery <= 3.59 – Authenticated (Administrator+) Stored Cross-Site Scripting
The NextGEN Gallery – Create an Amazing Photo Gallery in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.59 due to insufficient input sanitization and output…
*-3.59
3.59.1
26/04/2024
WordPress Gallery Plugin – NextGEN Gallery <= 3.59 – Missing Authorization to Unauthenticated Information Disclosure
The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible…
*-3.59
3.59.1
05/04/2024
NextGEN Gallery <= 3.37 – Cross-Site Request Forgery
The NextGEN Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.37. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated…
*-3.37
3.39
23/11/2023
WordPress Gallery Plugin – NextGEN Gallery <= 3.38 – Authenticated (Admin+) PHAR Deserialization
The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 3.38 via deserialization of untrusted input in the gallery_edit function. This makes it possible for authenticated…
*-3.38
3.39
25/09/2023
NextGEN Gallery <= 3.37 – Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit
The NextGEN Gallery plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in versions up to, and including, 3.37. This is due to insufficient input validation within the gallery_edit function. This makes it possible for authenticated…
*-3.37
3.39
25/09/2023
WordPress Gallery Plugin – NextGEN Gallery <= 3.38 – Authenticated (Admin+) Local File Inclusion
The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.38 via the 'Select View' field in the plugin's developer tools. This makes it possible…
*-3.38
3.39
25/09/2023
NextGEN Gallery <= 3.28 – Cross-Site Request Forgery leading to Post Thumbnail Change
The NextGEN Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.28. This is due to missing or incorrect nonce validation on the 'ajax_set_post_thumbnail' and 'createNewThumb' functions. This makes it possible…
*-3.28
3.29
14/02/2023
WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 – Cross-Site Request Forgery to Arbitrary File Upload
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
*-3.4.7
3.5.0
17/12/2020
WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 – Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF…
*-3.4.7
3.5.0
17/12/2020
NextGEN Gallery <= 3.2.10 – SQL Injection
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.
[*, 3.2.11)
3.2.11
27/08/2019
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.