Envira Gallery Lite Vulnerabilities

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVSS:

6.4

Affected:

up to 1.12.4

Fixed in:

1.12.5

Disclosed:

Aug 27, 2026

CVE-2026-3423 on NVD →

The Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.12.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.12.5

Fixed in:

1.12.6

Disclosed:

Jun 15, 2026

CVE-2026-54190 on NVD →

The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due to insufficient input sanitization in the update_gallery_data() function and improper output escaping in the gallery_init() function. The sanitize_config_values(...

CVSS:

6.4

Affected:

up to 1.12.4

Fixed in:

1.12.5

Disclosed:

May 13, 2026

CVE-2026-5361 on NVD →

The Envira Gallery for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'justified_gallery_theme' parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level ac...

CVSS:

6.4

Affected:

up to 1.12.3

Fixed in:

1.12.4

Disclosed:

Mar 3, 2026

CVE-2026-1236 on NVD →

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVSS:

4.3

Affected:

up to 1.12.0

Fixed in:

1.12.1

Disclosed:

Nov 12, 2025

CVE-2025-12377 on NVD →

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, w...

CVSS:

4.3

Affected:

up to 1.11.0

Fixed in:

1.12.0

Disclosed:

Nov 7, 2025

CVE-2025-11448 on NVD →

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 1.8.15

Fixed in:

1.8.16

Disclosed:

Dec 3, 2024

CVE-2024-5020 on NVD →

The Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the envira_gallery_ajax_load_gallery_data() function in versions up to, and including, 1.8.14. This makes it possible for authenticated attackers, with contributor-level access and above...

CVSS:

4.3

Affected:

up to 1.8.14

Fixed in:

1.8.15

Disclosed:

Aug 26, 2024

CVE-2024-43925 on NVD →

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery image title field in all versions up to, and including, 1.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Au...

CVSS:

6.4

Affected:

up to 1.8.14

Fixed in:

1.8.15

Disclosed:

Aug 20, 2024

CVE-2024-3899 on NVD →

The Envira Photo Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.7.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request granted they can trick a s...

CVSS:

4.3

Affected:

up to 1.8.7.3

Fixed in:

1.8.8

Disclosed:

Jun 20, 2024

CVE-2024-37095 on NVD →

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'envira_gallery_insert_images' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contr...

CVSS:

4.3

Affected:

up to 1.8.7.2

Fixed in:

1.8.7.3

Disclosed:

Jan 8, 2024

CVE-2023-6742 on NVD →

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in versions up to, and including, 1.8.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject ar...

CVSS:

6.1

Affected:

up to 1.8.4.7

Fixed in:

1.8.4.7

Disclosed:

Oct 10, 2022

CVE-2022-2190 on NVD →

Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata (namely title) before outputting them in the generated gallery, which could lead to privilege escalation.

CVSS:

5.4

Affected:

up to 1.8.3.3

Fixed in:

1.8.3.3

Disclosed:

Dec 19, 2020

CVE-2021-24126 on NVD →

A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.

CVSS:

6.4

Affected:

up to 1.7.7

Fixed in:

1.7.7

Disclosed:

Feb 25, 2020

CVE-2020-9334 on NVD →