CVE-2025-12377

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-leve...

Gallery Metabox <= 1.5 - Gallery Removal via CSRF

The plugin does not have CSRF check when removing galleries, which could allow attackers to make logged-in admins perform such action via a CSRF attack...