Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Photo Gallery, Sliders, Proofing and Themes 4.5.0 Clear all filters
TI-2026-56313 CVE-2026-81654 · GHSA-xcq4-7q66-rcp3

NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update

Priority LOW 15

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capab…

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00209 Published 2026-09-20 Fixed in 4.5.0 CWE-639
TI-2026-56312 CVE-2026-81653 · GHSA-vpjm-x6rh-jvwr

NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR

Priority LOW 19

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an admin…

CVSS 3.1MEDIUM 4.2 Network Low privileges No interaction EPSS 0.00188 Published 2026-09-20 Fixed in 4.5.0 CWE-639
TI-2026-56311 CVE-2026-81652 · GHSA-f6f9-8ghp-5wg5

NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR

Priority LOW 13

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00299 Published 2026-09-20 Fixed in 4.5.0 CWE-639
TI-2026-56310 CVE-2026-81651 · GHSA-w7wf-gqrx-wh54

NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR

Priority LOW 15

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite…

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00209 Published 2026-09-20 Fixed in 4.5.0 CWE-639
TI-2026-56309 CVE-2026-81650 · GHSA-j73p-vqpx-6v96

NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import

Priority LOW 34

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00499 Published 2026-09-20 Fixed in 4.5.0 CWE-434