plugin

Gallery Portfolio Vulnerabilities

6 known security issues reported for the Gallery Portfolio WordPress plugin. Most recent disclosed Dec 31, 2025.

3 medium

Running Gallery Portfolio on your site? Check whether your installed version is affected.

Scan your site free

Portfolio Gallery <= 1.4.8 - Missing Authorization

medium

The Portfolio Gallery plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:
4.3
Affected:
up to 1.4.8
Fix:
No patched version reported
Disclosed:
Dec 31, 2025

CVE-2025-62098 on NVD →

Portfolio Gallery &#8211; Responsive Image Gallery [gallery-portfolio] <= 1.4.8 (unfixed)

unknown

[en] Missing Authorization vulnerability in Totalsoft Portfolio Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery: from n/a through 1.4.8.

Affected:
up to 1.4.8
Fix:
No patched version reported
Disclosed:
Dec 31, 2025

CVE-2025-62098 on NVD →

Portfolio Gallery &#8211; Responsive Image Gallery [gallery-portfolio] < 1.4.6 (closed)

unknown

[en] Missing Authorization vulnerability in Total-Soft Portfolio Gallery – Responsive Image Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery – Responsive Image Gallery: from n/a through 1.4.6.

Affected:
up to 1.4.6
Fixed in:
1.4.6
Disclosed:
Dec 13, 2024

CVE-2023-32585 on NVD →

Gallery Portfolio <= 1.4.6 - Missing Authorization via Multiple AJAX actions

medium

The Gallery Portfolio plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to missing capability checks on multiple nopriv_ AJAX functions in versions up to, and including, 1.4.6. This makes it possible for unauthenticated attackers to edit and delete images, albums, and portfoli...

CVSS:
6.5
Affected:
up to 1.4.7
Fixed in:
1.4.7
Disclosed:
Aug 17, 2023

Portfolio Gallery &#8211; Responsive Image Gallery [gallery-portfolio] < 1.4.7 (closed)

unknown

The Gallery Portfolio plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to missing capability checks on multiple nopriv_ AJAX functions in versions up to, and including, 1.4.6. This makes it possible for unauthenticated attackers to edit and delete images, albums, and portfoli...

Affected:
up to 1.4.7
Fixed in:
1.4.7
Disclosed:
Aug 17, 2023

Portfolio Gallery – Responsive Image Gallery <= 1.4.5 - Missing Authorization to Arbitrary Gallery Deletion

medium

The Portfolio Gallery – Responsive Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the TotalSoftPortfolio_Del_Callback() function called via an AJAX action in versions up to, and including, 1.4.5. This makes it possible for unauthentica...

CVSS:
6.5
Affected:
up to 1.4.5
Fixed in:
1.4.6
Disclosed:
May 11, 2023

CVE-2023-32585 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database