Plugin security history

WP Easy Gallery – WordPress Gallery Plugin Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 10 vulnerability records associated with WP Easy Gallery – WordPress Gallery Plugin, published between 2013 and 2024.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

10Total records

2Critical

4High

4Medium

0Low

0Informational

7Patched records

3Currently marked unpatched

2013-02-18First disclosure

2024-09-30Latest disclosure

4 of 10CVE coverage

Use this history

Check and watch WP Easy Gallery – WordPress Gallery Plugin.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch WP Easy Gallery – WordPress Gallery Plugin

Year-by-Year Timeline

Year	Records	Relative volume
2013	1	1 records
2014	5	5 records
2016	1	1 records
2024	3	3 records

Severity Breakdown

Severity	Records	Share
Critical	2	20%
High	4	40%
Medium	4	40%

Vulnerability-Type Breakdown

SQL Injection

5 records50%

First: 2013. Latest: 2024.

Cross-Site Scripting

3 records30%

First: 2014. Latest: 2016.

CSRF

1 record10%

First: 2014. Latest: 2014.

Missing Authorization

1 record10%

First: 2024. Latest: 2024.

Patch Status

Patched: 7
Currently marked unpatched: 3
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.1.5
4.1.1
1.8
2.7.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.8.5`	WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter	September 30, 2024	Not supplied	High
`*-4.8.5`	WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection	September 23, 2024	Not supplied	Critical
`*-4.8.5`	WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation	September 23, 2024	Not supplied	Medium
`[*, 4.1.5)`	WP Easy Gallery <= 4.1.4 - Stored Cross-Site Scripting	January 26, 2016	4.1.5	Medium
`*-2.7`	WP Easy Gallery <= 2.7 - SQL Injection	August 1, 2014	2.7.1	High
`*-2.7`	WP Easy Gallery <= 2.7 - Cross-Site Request Forgery	August 1, 2014	2.7.1	High
`[*, 4.1.1)`	PrettyPhoto Library (Multiple Plugins and Themes) <= 3.1.4 - DOM Cross-Site Scripting	August 1, 2014	4.1.1	Medium
`*-1.7`	WP Easy Gallery <= 1.7 - Cross-Site Scripting	August 1, 2014	1.8	Medium
`*-2.7`	WP Easy Gallery <= 2.7 - SQL Injection	August 1, 2014	2.7.1	High
`*-2.7`	WP Easy Gallery <= 2.7 - SQL Injection	February 18, 2013	2.7.1	Critical

Selected source records

Latest Records

HighCVE-2024-9018

WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter

Published: September 30, 2024

Affected versions: *-4.8.5
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2024-8436

WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection

Published: September 23, 2024

Affected versions: *-4.8.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2024-8437

WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation

Published: September 23, 2024

Affected versions: *-4.8.5
Patched versions: Not supplied

Original Wordfence record

Medium

WP Easy Gallery <= 4.1.4 - Stored Cross-Site Scripting

Published: January 26, 2016

Affected versions: [*, 4.1.5)
Patched versions: 4.1.5

Original Wordfence record

High

WP Easy Gallery <= 2.7 - SQL Injection

Published: August 1, 2014

Affected versions: *-2.7
Patched versions: 2.7.1

Original Wordfence record

Medium

WP Easy Gallery <= 1.7 - Cross-Site Scripting

Published: August 1, 2014

Affected versions: *-1.7
Patched versions: 1.8

Original Wordfence record

MediumCVE-2013-6837

PrettyPhoto Library (Multiple Plugins and Themes) <= 3.1.4 - DOM Cross-Site Scripting

Published: August 1, 2014

Affected versions: [*, 7.5)
Patched versions: 7.5

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.4.12)
Patched versions: 1.4.12

Affected versions: [*, 0.4.17)
Patched versions: 0.4.17

Affected versions: [*, 5.5)
Patched versions: 5.5

Affected versions: [*, 1.7.5)
Patched versions: 1.7.5

Affected versions: [*, 1.2.7.5)
Patched versions: 1.2.7.5

Affected versions: [*, 2.1.3)
Patched versions: 2.1.3

Affected versions: [*, 4.1.1)
Patched versions: 4.1.1

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 3.0.229)
Patched versions: 3.0.229

Affected versions: [*, 3.1.5)
Patched versions: 3.1.5

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1)
Patched versions: 1.1

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.2.0)
Patched versions: 1.2.0

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.1.7)
Patched versions: 2.1.7

Affected versions: [*, 6.6)
Patched versions: 6.6

Affected versions: [*, 2.0.0)
Patched versions: 2.0.0

Affected versions: [*, 4.6.1)
Patched versions: 4.6.1

Affected versions: [*, 2.0.227)
Patched versions: 2.0.227

Affected versions: [*, 1.1.7)
Patched versions: 1.1.7

Affected versions: [*, 3.3)
Patched versions: 3.3

Affected versions: [*, 2.11.8.18)
Patched versions: 2.11.8.18

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 0.0.8)
Patched versions: 0.0.8

Affected versions: *-0.1
Patched versions: 0.2

Affected versions: [*, 5.4)
Patched versions: 5.4

Affected versions: [*, 2.5.2)
Patched versions: 2.5.2

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Original Wordfence record

High

WP Easy Gallery <= 2.7 - Cross-Site Request Forgery

Published: August 1, 2014

Affected versions: *-2.7
Patched versions: 2.7.1

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-8436

WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection

Published: September 23, 2024

Affected versions: *-4.8.5
Patched versions: Not supplied

Original Wordfence record

Critical

WP Easy Gallery <= 2.7 - SQL Injection

Published: February 18, 2013

Affected versions: *-2.7
Patched versions: 2.7.1

Original Wordfence record

High

WP Easy Gallery <= 2.7 - Cross-Site Request Forgery

Published: August 1, 2014

Affected versions: *-2.7
Patched versions: 2.7.1

Original Wordfence record

HighCVE-2024-9018

WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter

Published: September 30, 2024

Affected versions: *-4.8.5
Patched versions: Not supplied

Original Wordfence record

High

WP Easy Gallery <= 2.7 - SQL Injection

Published: August 1, 2014

Affected versions: *-2.7
Patched versions: 2.7.1

Original Wordfence record

High

WP Easy Gallery <= 2.7 - SQL Injection

Published: August 1, 2014

Affected versions: *-2.7
Patched versions: 2.7.1

Original Wordfence record

Medium

WP Easy Gallery <= 4.1.4 - Stored Cross-Site Scripting

Published: January 26, 2016

Affected versions: [*, 4.1.5)
Patched versions: 4.1.5

Original Wordfence record

Medium

WP Easy Gallery <= 1.7 - Cross-Site Scripting

Published: August 1, 2014

Affected versions: *-1.7
Patched versions: 1.8

Original Wordfence record

Currently Marked Unpatched Records

HighCVE-2024-9018

WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter

Published: September 30, 2024

Affected versions: *-4.8.5
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2024-8436

WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection

Published: September 23, 2024

Affected versions: *-4.8.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2024-8437

WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation

Published: September 23, 2024

Affected versions: *-4.8.5
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory