Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More vulnerabilities

Product

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More

by smub · last CVE Aug 28, 2026

CVEs

On KEV

6.4

Max CVSS

New 30D

Severity mix

Critical 0High 0Medium 7Low 0

Severity

Exploitation

Watch

Add Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-3423	6.4	0%	Aug 28	Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description Affected: through 1.12.4
CVE-2026-5361	6.4	0%	May 14	Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter Affected: through 1.12.4
CVE-2026-1236	6.4	0%	Mar 4	Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API Affected: through 1.12.3
CVE-2024-5020	6.4	0%	Dec 4	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Affected: through 1.8.15
CVE-2025-12377	4.3	0%	Nov 13	Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions Affected: through 1.12.0
CVE-2025-11448	4.3	0%	Nov 8	Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion Affected: through 1.11.0
CVE-2023-6742	4.3	0%	Jan 11	Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images Affected: through 1.8.7.2