What’s Vulnerable › Products
smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More vulnerabilities
15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.
Latest smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More vulnerabilities
- CVE-2026-3423 — Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description (CVSS 6.4)
- CVE-2026-5361 — Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter (CVSS 6.4)
- CVE-2026-1236 — Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API (CVSS 6.4)
- CVE-2025-12377 — Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions (CVSS 4.3)
- CVE-2025-11448 — Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion (CVSS 4.3)
- CVE-2024-5020 — Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
- CVE-2024-43925 — WordPress Envira Gallery Lite plugin <= 1.8.14 - Broken Access Control vulnerability (CVSS 8.8)
- CVE-2024-37095 — WordPress Envira Photo Gallery plugin <= 1.8.7.3 - CSRF leading to notice dismissal vulnerability (CVSS 4.3)
- CVE-2024-3899 — Envira Gallery < 1.8.15 - Author+ Stored XSS (CVSS 4.8)
- CVE-2023-6742 — Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images (CVSS 4.3)
- CVE-2022-2190 — Envira Gallery Lite < 1.8.4.7 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2021-24126 — Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2020-35582 — (CVSS 5.4)
- CVE-2020-35581 — (CVSS 5.4)
- CVE-2020-9334 — (CVSS 5.4)