Photo Gallery Sliders Proofing And Themes Nextgen Gallery
Monthly
Remote code execution in the NextGEN Gallery WordPress plugin affects all versions through 4.4.1, where an authenticated attacker who owns at least one gallery can chain mass assignment of meta_data keys, missing realpath containment in render_image path construction, and a bypassable public image-delivery signature check to execute code on the server. The requirement is easier to retain than it appears: a Subscriber who was ever granted the 'NextGEN Manage gallery' capability keeps gallery-author access after revocation because _can_manage_gallery() falls back to stored ownership. No public exploit was identified at time of analysis; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Remote code execution in the WordPress plugin NextGEN Gallery, affecting all versions up to and including 4.4.1, requires an authenticated attacker holding a custom-level role or above who is also the stored author of at least one existing NextGEN gallery - gallery ownership is the only authorization check standing between that account and the vulnerable upload path. Abuse of the Lightroom gallery_edit endpoint lets that author mass-assign the gallery path and upload a file into a registered template directory, which the legacy_render function then executes. The attack is gated rather than open: it is not unauthenticated and it is not exploitable on default configurations that do not hand untrusted users custom+ roles or gallery authorship, which is why CVSS rates attack complexity high despite the full confidentiality, integrity and availability impact; no public exploit was identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
The NextGEN Gallery plugin for WordPress contains a Local File Inclusion vulnerability in the 'template' parameter of gallery shortcodes, affecting all versions up to and including 4.0.3. Authenticated attackers with Author-level privileges or higher can include and execute arbitrary PHP files on the server, potentially leading to remote code execution, data theft, or complete site compromise. This is a confirmed vulnerability reported by Wordfence with a high CVSS score of 8.8, though no active exploitation (KEV) status has been reported at this time.
Stored DOM-based cross-site scripting in the NextGEN Gallery WordPress plugin (all versions up to and including 4.5.4) lets an unauthenticated attacker place script payloads through the 'comment' parameter that later execute in the browser of any visitor viewing the affected gallery page. Two concrete preconditions gate every attack: the site must have the Shutter or Shutter Reloaded lightbox selected as active (sites using another lightbox are not exposed), and the injected comment must pass WordPress's standard moderation workflow and be approved before it is rendered. Rated CVSS 5.4 with High attack complexity for exactly those reasons; there is no KEV listing and no public exploit identified at time of analysis, and an upstream fix is present in the plugin's trunk changeset 3773860, though a tagged patched release is not independently confirmed in the supplied data.
Insecure Direct Object Reference in NextGEN Gallery WordPress plugin through version 4.2.0 allows authenticated attackers with Subscriber-level privileges and the 'NextGEN Manage gallery' capability to delete gallery images belonging to other users, including their physical files from disk. The DELETE /imagely/v1/images/{id} REST endpoint validates only the 'NextGEN Manage gallery' capability, entirely omitting gallery ownership checks and the 'NextGEN Manage others gallery' permission - making cross-user image destruction possible at low privilege. No public exploit code identified at time of analysis and no CISA KEV listing; however, when deleteImg is enabled (default), exploitation results in irreversible file-level data loss beyond what the CVSS 4.3 integrity score alone conveys.
Remote code execution in the NextGEN Gallery WordPress plugin affects all versions through 4.4.1, where an authenticated attacker who owns at least one gallery can chain mass assignment of meta_data keys, missing realpath containment in render_image path construction, and a bypassable public image-delivery signature check to execute code on the server. The requirement is easier to retain than it appears: a Subscriber who was ever granted the 'NextGEN Manage gallery' capability keeps gallery-author access after revocation because _can_manage_gallery() falls back to stored ownership. No public exploit was identified at time of analysis; the CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Remote code execution in the WordPress plugin NextGEN Gallery, affecting all versions up to and including 4.4.1, requires an authenticated attacker holding a custom-level role or above who is also the stored author of at least one existing NextGEN gallery - gallery ownership is the only authorization check standing between that account and the vulnerable upload path. Abuse of the Lightroom gallery_edit endpoint lets that author mass-assign the gallery path and upload a file into a registered template directory, which the legacy_render function then executes. The attack is gated rather than open: it is not unauthenticated and it is not exploitable on default configurations that do not hand untrusted users custom+ roles or gallery authorship, which is why CVSS rates attack complexity high despite the full confidentiality, integrity and availability impact; no public exploit was identified at time of analysis and there is no CISA KEV confirmation of active exploitation.
The NextGEN Gallery plugin for WordPress contains a Local File Inclusion vulnerability in the 'template' parameter of gallery shortcodes, affecting all versions up to and including 4.0.3. Authenticated attackers with Author-level privileges or higher can include and execute arbitrary PHP files on the server, potentially leading to remote code execution, data theft, or complete site compromise. This is a confirmed vulnerability reported by Wordfence with a high CVSS score of 8.8, though no active exploitation (KEV) status has been reported at this time.
Stored DOM-based cross-site scripting in the NextGEN Gallery WordPress plugin (all versions up to and including 4.5.4) lets an unauthenticated attacker place script payloads through the 'comment' parameter that later execute in the browser of any visitor viewing the affected gallery page. Two concrete preconditions gate every attack: the site must have the Shutter or Shutter Reloaded lightbox selected as active (sites using another lightbox are not exposed), and the injected comment must pass WordPress's standard moderation workflow and be approved before it is rendered. Rated CVSS 5.4 with High attack complexity for exactly those reasons; there is no KEV listing and no public exploit identified at time of analysis, and an upstream fix is present in the plugin's trunk changeset 3773860, though a tagged patched release is not independently confirmed in the supplied data.
Insecure Direct Object Reference in NextGEN Gallery WordPress plugin through version 4.2.0 allows authenticated attackers with Subscriber-level privileges and the 'NextGEN Manage gallery' capability to delete gallery images belonging to other users, including their physical files from disk. The DELETE /imagely/v1/images/{id} REST endpoint validates only the 'NextGEN Manage gallery' capability, entirely omitting gallery ownership checks and the 'NextGEN Manage others gallery' permission - making cross-user image destruction possible at low privilege. No public exploit code identified at time of analysis and no CISA KEV listing; however, when deleteImg is enabled (default), exploitation results in irreversible file-level data loss beyond what the CVSS 4.3 integrity score alone conveys.