What’s Vulnerable › Vulnerabilities
CVE-2015-9538
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 10.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-11-26 · updated 2026-06-17
- Weakness: CWE-22
Description
The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.
Affected products
- Photo Gallery, Sliders, Proofing and Themes: before 2.1.15 — fixed in 2.1.15
How to fix
Upgrade to a fixed version: Photo Gallery, Sliders, Proofing and Themes 2.1.15. Check the vendor advisory for mitigations.
References
- https://cxsecurity.com/issue/WLB-2015080165
- https://cybersecurityworks.com/zerodays/cve-2015-9538-nextgen.html
- https://github.com/cybersecurityworks/Disclosed/issues/2
- https://packetstormsecurity.com/files/135114/WordPress-NextGEN-Gallery-2.1.15-Cross-Site-Scripting-Path-Traversal.html
- https://wordpress.org/plugins/nextgen-gallery/#developers
- https://www.openwall.com/lists/oss-security/2015/08/28/4
- https://www.openwall.com/lists/oss-security/2015/09/01/7
- https://cxsecurity.com/issue/WLB-2015080165
- https://cybersecurityworks.com/zerodays/cve-2015-9538-nextgen.html
- https://github.com/cybersecurityworks/Disclosed/issues/2
- https://packetstormsecurity.com/files/135114/WordPress-NextGEN-Gallery-2.1.15-Cross-Site-Scripting-Path-Traversal.html
- https://wordpress.org/plugins/nextgen-gallery/#developers
Get alerted when CVE-2015-9538 or the next vulnerability affects your stack