EUVD-2026-83666

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

CVE-2026-81653

The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin versions before 4.5.0 is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that a user owns the gallery associated with a specific image. Consequently, users granted g...

CVE-2026-81651

The NextGEN Gallery WordPress plugin (versions before 4.5.0 ) is vulnerable to an authenticated cross-gallery settings modification due to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify gallery ownership when a user saves settings, allowing any user with gallery-manag...

EUVD-2026-83663

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

CVE-2026-81650 NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Authenticated Cross-Gallery Settings Modification vulnerability

Authenticated Cross-Gallery Settings Modification vulnerability discovered by Murad Akhmedov in WordPress Plugin NextGEN Gallery versions 4.5.0...

CVE-2026-81651 NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

CVE-2026-81650

The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin, in versions before 4.5.0 , is vulnerable to an authenticated arbitrary file upload . The root cause is a logic error where a variable is reused as a loop counter, causing the plugin to fail to correctly validate t...

CVE-2026-81651 NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

CVE-2026-81650 NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

CVE-2026-81652

The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin before version 4.5.0 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify if a requesting user is entitled to a specific image record before returning it. This allows us...

CVE-2026-81652 NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

CVE-2026-81652 NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

EUVD-2026-83662

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Contributor+ Image Metadata Disclosure vulnerability

Contributor+ Image Metadata Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin NextGEN Gallery versions 4.5.0...

EUVD-2026-83664

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

PT-2026-95917

Name of the Vulnerable Software and Affected Versions Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description Insufficient verification of user entitlements allows users with the Contributor role and above to access stored metadata of any image on the site,...

PT-2026-95928

Name of the Vulnerable Software and Affected Versions Meow Gallery versions prior to 5.5.5 Description Insufficient sanitization of user-supplied values allows unauthenticated users to execute arbitrary registered shortcodes. This occurs when input is concatenated into a shortcode string and pass...

PT-2026-95916

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if the user saving a gallery is the actual owner. This allows any user with the gallery-management capability to overwrite...

CVE-2026-81653: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...