Skip to contentSmub Photo Gallery, Sliders, Proofing And Themes – Nextgen Gallery vulnerabilities
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes <= 4.5.5 - Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' ParametersCVE-2026-1181918.1 High
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path TraversalCVE-2026-760108.8 High
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTMLCVE-2026-1165635.4 Medium
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image UploadCVE-2026-760127.5 High
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST APICVE-2026-65664.3 Medium
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File InclusionCVE-2026-14638.8 High
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'CVE-2025-136418.8 High
- denis-de-bernardy auto thickbox, smub photo gallery, sliders, proofing and themes – nextgen gallery, wpdevart youtube embed, playlist and popup by wpdevart +2 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript LibraryCVE-2025-25376.4 Medium
- aknieriem simplelightbox, smub photo gallery, sliders, proofing and themes – nextgen gallery +1 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript LibraryCVE-2024-58786.4 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builder, bqworks accordion slider, colorlibplugins fancybox for wordpress +13 more +15 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryCVE-2024-50206.4 Medium
- imagely nextgen gallery, smub photo gallery, sliders, proofing and themes – nextgen gallery +1 moreWordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information DisclosureCVE-2024-3097EPSS 38.0%5.3 Medium