CVE-2026-81654

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

CVE-2026-81650

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

CVE-2026-81653

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

CVE-2026-81651

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

CVE-2026-81652

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

EUVD-2026-83665

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

EUVD-2026-83666

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Authenticated Cross-Gallery Settings Modification vulnerability

Authenticated Cross-Gallery Settings Modification vulnerability discovered by Murad Akhmedov in WordPress Plugin NextGEN Gallery versions 4.5.0...

EUVD-2026-83664

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in...

CVE-2026-81650

The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin, in versions before 4.5.0 , is vulnerable to an authenticated arbitrary file upload . The root cause is a logic error where a variable is reused as a loop counter, causing the plugin to fail to correctly validate t...

EUVD-2026-83662

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

EUVD-2026-83663

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Contributor+ Image Metadata Disclosure vulnerability

Contributor+ Image Metadata Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin NextGEN Gallery versions 4.5.0...

CVE-2026-81650: Unrestricted Upload of File with Dangerous Type

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...

PT-2026-95915

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to correctly validate file extensions when extracting files from an uploaded archive. This occurs because a variable is reused as a...

CVE-2026-81653: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

PT-2026-95916

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if the user saving a gallery is the actual owner. This allows any user with the gallery-management capability to overwrite...

PT-2026-95919

Name of the Vulnerable Software and Affected Versions Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if a user possesses the required options capability before saving image sizing settings. This allows users who have only been...

PT-2026-95918

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if the user performing an action on an image is the owner of the gallery to which the image belongs. This allows users who...

CVE-2026-81654: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...