CVE-2026-81651

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

CVE-2026-81652

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

CVE-2026-81650

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

CVE-2026-81654

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

CVE-2026-81653

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

EUVD-2026-83666

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

EUVD-2026-83665

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

EUVD-2026-83663

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Authenticated Cross-Gallery Settings Modification vulnerability

Authenticated Cross-Gallery Settings Modification vulnerability discovered by Murad Akhmedov in WordPress Plugin NextGEN Gallery versions 4.5.0...

EUVD-2026-83662

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

CVE-2026-81650

The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin, in versions before 4.5.0 , is vulnerable to an authenticated arbitrary file upload . The root cause is a logic error where a variable is reused as a loop counter, causing the plugin to fail to correctly validate t...

EUVD-2026-83664

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Contributor+ Image Metadata Disclosure vulnerability

Contributor+ Image Metadata Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin NextGEN Gallery versions 4.5.0...

CVE-2026-81654: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

CVE-2026-81651: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

PT-2026-95916

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if the user saving a gallery is the actual owner. This allows any user with the gallery-management capability to overwrite...

CVE-2026-81650: Unrestricted Upload of File with Dangerous Type

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

CVE-2026-81653: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

PT-2026-95917

Name of the Vulnerable Software and Affected Versions Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description Insufficient verification of user entitlements allows users with the Contributor role and above to access stored metadata of any image on the site,...

CVE-2026-81652: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...