Plugin security history

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 43 vulnerability records associated with Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery, published between 2008 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

43Total records

3Critical

16High

24Medium

0Low

0Informational

43Patched records

0Currently marked unpatched

2008-06-07First disclosure

2026-05-20Latest disclosure

37 of 43CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2008	1	1 records
2010	1	1 records
2012	2	2 records
2013	2	2 records
2014	2	2 records
2015	7	7 records
2016	2	2 records
2017	1	1 records
2018	2	2 records
2019	3	3 records
2020	2	2 records
2023	5	5 records
2024	6	6 records
2025	4	4 records
2026	3	3 records

Severity Breakdown

Severity	Records	Share
Critical	3	7%
High	16	37.2%
Medium	24	55.8%

Vulnerability-Type Breakdown

Cross-Site Scripting

15 records34.9%

First: 2008. Latest: 2025.

Other

7 records16.3%

First: 2015. Latest: 2026.

CSRF

5 records11.6%

First: 2015. Latest: 2023.

Arbitrary File Upload

4 records9.3%

First: 2013. Latest: 2015.

SQL Injection

4 records9.3%

First: 2016. Latest: 2026.

Path Traversal

3 records7%

First: 2014. Latest: 2023.

Missing Authorization

3 records7%

First: 2019. Latest: 2026.

Information Disclosure

2 records4.7%

First: 2013. Latest: 2018.

Patch Status

Patched: 43
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.2.1
4.0.5
4.0.0
3.59.12
3.59.5
3.59.9
3.39.5
3.59.4
3.59.3
3.59.1
3.39
3.29
3.5.0
3.2.11
3.1.7
3.1.6
2.2.50
2.2.45
2.1.79
2.1.57
2.1.23
2.1.10
2.1.9
2.1.15
2.0.77.3
2.0.66
2.0.7
1.9.13
2.0.0
1.9.7
1.9.8
1.5.2
1.9.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`[*, 4.2.1)`	Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection	May 20, 2026	4.2.1	Medium
`*-4.2.0`	Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API	May 19, 2026	4.2.1	Medium
`*-4.0.4`	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion	March 17, 2026	4.0.5	High
`*-3.59.12`	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'	December 17, 2025	4.0.0	High
`*-3.59.11`	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library	July 3, 2025	3.59.12	Medium
`*-3.59.4`	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library	May 19, 2025	3.59.5	Medium
`*-3.59.8`	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting	February 4, 2025	3.59.9	Medium
`*-3.59.4`	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library	December 3, 2024	3.59.5	Medium
`*-3.39.4`	NextGEN Gallery <= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting	November 4, 2024	3.39.5	Medium
`*-3.59.3`	NextGEN Gallery <= 3.59.3 - Authenticated (Administrator+) Stored Cross-Site Scripting	July 22, 2024	3.59.4	Medium
`*-3.59.2`	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery	June 22, 2024	3.59.3	Medium
`*-3.59`	Nextgen Gallery <= 3.59 - Authenticated (Administrator+) Stored Cross-Site Scripting	April 26, 2024	3.59.1	Medium
`*-3.59`	WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure	April 5, 2024	3.59.1	Medium
`*-3.37`	NextGEN Gallery <= 3.37 - Cross-Site Request Forgery	November 23, 2023	3.39	Medium
`*-3.38`	WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) PHAR Deserialization	September 25, 2023	3.39	High
`*-3.37`	NextGEN Gallery <= 3.37 - Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit	September 25, 2023	3.39	Medium
`*-3.38`	WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) Local File Inclusion	September 25, 2023	3.39	Medium
`*-3.28`	NextGEN Gallery <= 3.28 - Cross-Site Request Forgery leading to Post Thumbnail Change	February 14, 2023	3.29	Medium
`*-3.4.7`	WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery to Arbitrary File Upload	December 17, 2020	3.5.0	High
`*-3.4.7`	WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery	December 17, 2020	3.5.0	High
`[*, 3.2.11)`	NextGEN Gallery <= 3.2.10 - SQL Injection	August 27, 2019	3.2.11	Critical
`[*, 3.1.7)`	Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update	February 25, 2019	3.1.7	High
`*-3.1.5`	NextGen Gallery <= 3.1.5 - PHP Object Injection	February 4, 2019	3.1.6	High
`*-2.2.46`	WordPress Gallery Plugin – NextGEN Gallery <= 2.2.46 - Sensitive Information Disclosure	March 2, 2018	2.2.50	High
`*-2.2.44`	NextGEN Gallery <= 2.2.44 - Cross-Site Scripting via image alt and title text	February 14, 2018	2.2.45	Medium

Selected source records

Latest Records

MediumCVE-2026-9059

Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection

Published: May 20, 2026

Affected versions: [*, 4.2.1)
Patched versions: 4.2.1

Original Wordfence record

MediumCVE-2026-6566

Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API

Published: May 19, 2026

Affected versions: *-4.2.0
Patched versions: 4.2.1

Original Wordfence record

HighCVE-2026-1463

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion

Published: March 17, 2026

Affected versions: *-4.0.4
Patched versions: 4.0.5

Original Wordfence record

HighCVE-2025-13641

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'

Published: December 17, 2025

Affected versions: *-3.59.12
Patched versions: 4.0.0

Original Wordfence record

MediumCVE-2025-2537

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library

Published: July 3, 2025

Affected versions: *-3.5
Patched versions: Not supplied

Affected versions: *-2.6.7
Patched versions: Not supplied

Affected versions: *-3.59.11
Patched versions: 3.59.12

Original Wordfence record

MediumCVE-2024-5878

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library

Published: May 19, 2025

Affected versions: *-2.14.4
Patched versions: Not supplied

Affected versions: *-3.59.4
Patched versions: 3.59.5

Original Wordfence record

MediumCVE-2024-10545

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: February 4, 2025

Affected versions: *-3.59.8
Patched versions: 3.59.9

Original Wordfence record

MediumCVE-2024-5020

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

Published: December 3, 2024

Affected versions: *-2.4.8
Patched versions: 2.4.9

Affected versions: *-4.1.1
Patched versions: 4.1.2

Affected versions: *-1.9.12
Patched versions: 1.9.13

Affected versions: *-7.5.47.7212
Patched versions: 7.5.48.7212

Affected versions: *-1.8.15
Patched versions: 1.8.16

Affected versions: *-1.0.286
Patched versions: 1.0.288

Affected versions: *-3.3.9
Patched versions: 3.3.10

Affected versions: *-2.0.11
Patched versions: 2.0.12

Affected versions: *-2.3.3
Patched versions: 2.3.4

Affected versions: *-4.3.1
Patched versions: 4.3.2

Affected versions: *-3.3.4
Patched versions: 3.3.5

Affected versions: *-2.6.8
Patched versions: 2.6.9

Affected versions: *-1.15.27
Patched versions: 1.15.28

Affected versions: *-3.59.4
Patched versions: 3.59.5

Affected versions: *-6.6.2
Patched versions: Not supplied

Original Wordfence record

Highest-Severity Records

CriticalCVE-2013-3684

WordPress Gallery Plugin – NextGEN Gallery <= 1.9.12 - Arbitrary File Upload

Published: June 13, 2013

Affected versions: *-1.9.12
Patched versions: 1.9.13

Original Wordfence record

CriticalCVE-2016-10889

NextGEN Gallery <= 2.1.56 - Authenticated Local File Inclusion & SQL injection

Published: November 15, 2016

Affected versions: *-2.1.56
Patched versions: 2.1.57

Original Wordfence record

CriticalCVE-2019-14314

NextGEN Gallery <= 3.2.10 - SQL Injection

Published: August 27, 2019

Affected versions: [*, 3.2.11)
Patched versions: 3.2.11

Original Wordfence record

HighCVE-2025-13641

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'

Published: December 17, 2025

Affected versions: *-3.59.12
Patched versions: 4.0.0

Original Wordfence record

HighCVE-2015-1784

WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Cross-Site Request Forgery

Published: March 25, 2015

Affected versions: [*, 2.0.77.3)
Patched versions: 2.0.77.3

Original Wordfence record

HighCVE-2020-35942

WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery

Published: December 17, 2020

Affected versions: *-3.4.7
Patched versions: 3.5.0

Original Wordfence record

HighCVE-2026-1463

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion

Published: March 17, 2026

Affected versions: *-4.0.4
Patched versions: 4.0.5

Original Wordfence record

HighCVE-2020-35943

WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery to Arbitrary File Upload

Published: December 17, 2020

Affected versions: *-3.4.7
Patched versions: 3.5.0

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory