Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery vulnerabilities

Product

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

by smub · last CVE Oct 31, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities10 In the news0 Timeline

Severity mix

Critical 0High 4Medium 6Low 0

Severity

All severities10 Critical0 High4 Medium6 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-76010 New	8.8	1%	Oct 31	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal Affected: through 4.4.1
CVE-2026-1463	8.8	0%	Mar 18	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion Affected: through 4.0.4
CVE-2025-13641	8.8	1%	Dec 18	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template' Affected: through 3.59.12
CVE-2026-76012 New	7.5	1%	Oct 30	Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload Affected: through 4.4.1
CVE-2025-2537	6.4	0%	Jul 3	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library Affected: through 3.59.11
CVE-2024-5878	6.4	0%	May 20	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library Affected: through 3.59.4
CVE-2024-5020	6.4	0%	Dec 4	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Affected: through 3.59.4
CVE-2026-116563 New	5.4	0%	Oct 31	Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML Affected: through 4.5.4
CVE-2024-3097	5.3	38%	Apr 9	WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure Affected: through 3.59
CVE-2026-6566	4.3	0%	May 20	Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API Affected: through 4.2.0