Navz Photo Gallery Vulnerabilities

The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "acf_photo_gallery_edit_save" function in all versions up to, and including, 3.0. This makes it possible for authenticated attackers, with subscriber level access and above, to mo...

CVSS:

4.3

Affected:

up to 3.0

Fixed in:

3.1

Disclosed:

Feb 18, 2026

CVE-2025-12081 on NVD →

The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the apgf_update_donation function in versions up to and including 2.6. This makes it possible for authenticated attackers, with subscriber access and above, to update a plugin option.

CVSS:

4.3

Affected:

up to 2.6

Fixed in:

2.7

Disclosed:

Jan 30, 2024

CVE-2024-23518 on NVD →

The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with subscriber-level permissions or above, to update the...

CVSS:

4.3

Affected:

up to 1.9

Fixed in:

2.0

Disclosed:

Jul 26, 2023

CVE-2023-3957 on NVD →

The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue

CVSS:

6.1

Affected:

up to 1.7.4

Fixed in:

1.7.5

Disclosed:

Dec 20, 2021

CVE-2021-24909 on NVD →