EG
Product
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
7
CVEs
0
On KEV
6.4
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 7Low 0
Watch
Add Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-3423 | 6.4 | Aug 28 | Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description Affected: through 1.12.4 |
| CVE-2026-5361 | 6.4 | May 14 | Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter Affected: through 1.12.4 |
| CVE-2026-1236 | 6.4 | Mar 4 | Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API Affected: through 1.12.3 |
| CVE-2024-5020 | 6.4 | Dec 4 | Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Affected: through 1.8.15 |
| CVE-2025-12377 | 4.3 | Nov 13 | Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions Affected: through 1.12.0 |
| CVE-2025-11448 | 4.3 | Nov 8 | Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion Affected: through 1.11.0 |
| CVE-2023-6742 | 4.3 | Jan 11 | Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images Affected: through 1.8.7.2 |
Showing 7