Known vulnerabilities in Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

The most popular gallery plugin that lets you create galleries and albums in seconds.

40Reported vulnerabilities

9.8Highest CVSS score

4.3.0Latest version

300,000+Active installs

What to do now

Update Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery to 4.2.4 or later. 40 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 10, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2019-14314	Critical 9.8	43.4%	Before 3.2.10	`3.2.10`	August 27, 2019
CVE-2024-3097	Medium 5.3	38.0%	Before 3.59.1	`3.59.1`	April 9, 2024
CVE-2013-0291	High 7.5	15.6%	1.9.10 to 1.9.10 (inclusive) 1.9.11 to 1.9.11 (inclusive)	`2.0.0`	January 30, 2020
CVE-2013-3684	Critical 9.8	19.2%	Before 1.9.13	`1.9.13`	February 11, 2020
CVE-2015-9538	Medium 6.5	10.1%	Before 2.1.15	`2.1.15`	November 26, 2019
CVE-2015-1784	High 8.8	2.0%	Before 2.0.77.3	`2.0.77.3`	July 7, 2022
CVE-2020-35942	High 8.8	1.4%	Before 3.5.0	`3.5.0`	February 9, 2021
CVE-2023-3154	High 7.5	0.7%	Before 3.39	`3.39`	October 16, 2023
CVE-2023-3155	High 7.2	0.8%	Before 3.39	`3.39`	October 16, 2023
CVE-2015-1785	Medium 6.5	0.7%	Before 2.0.77.3	`2.0.77.3`	July 7, 2022
CVE-2020-35943	Medium 6.5	0.7%	Before 3.5.0	`3.5.0`	February 9, 2021
CVE-2016-10889	Critical 9.8	1.8%	Before 2.1.57	`2.1.57`	August 14, 2019
CVE-2015-9228	High 8.8	3.7%	1.5.0 to 1.5.0 (inclusive) 1.5.1 to 1.5.1 (inclusive) 1.5.2 to 1.5.2 (inclusive) 1.5.3 to 1.5.3 (inclusive) 1.5.4 to 1.5.4 (inclusive) 1.5.5 to 1.5.5 (inclusive) 1.6.0 to 1.6.0 (inclusive) 1.6.1 to 1.6.1 (inclusive) 1.6.2 to 1.6.2 (inclusive) 1.7.0 to 1.7.0 (inclusive) 1.7.1 to 1.7.1 (inclusive) 1.7.2 to 1.7.2 (inclusive) 1.7.3 to 1.7.3 (inclusive) 1.7.4 to 1.7.4 (inclusive) 1.8.0 to 1.8.0 (inclusive) 1.8.1 to 1.8.1 (inclusive) 1.8.2 to 1.8.2 (inclusive) 1.8.3 to 1.8.3 (inclusive) 1.8.4 to 1.8.4 (inclusive) 1.9.0 to 1.9.0 (inclusive) 1.9.1 to 1.9.1 (inclusive) 1.9.2 to 1.9.2 (inclusive) 1.9.3 to 1.9.3 (inclusive) 1.9.5 to 1.9.5 (inclusive) 1.9.6 to 1.9.6 (inclusive) 1.9.7 to 1.9.7 (inclusive) 1.9.8 to 1.9.8 (inclusive) 1.9.10 to 1.9.10 (inclusive) 1.9.11 to 1.9.11 (inclusive) 1.9.12 to 1.9.12 (inclusive) 1.9.13 to 1.9.13 (inclusive) 2.0 to 2.0 (inclusive) 2.0.7 to 2.0.7 (inclusive) 2.0.11 to 2.0.11 (inclusive) 2.0.14 to 2.0.14 (inclusive) 2.0.17 to 2.0.17 (inclusive) 2.0.21 to 2.0.21 (inclusive) 2.0.23 to 2.0.23 (inclusive) 2.0.25 to 2.0.25 (inclusive) 2.0.27 to 2.0.27 (inclusive) 2.0.30 to 2.0.30 (inclusive) 2.0.31 to 2.0.31 (inclusive) 2.0.33 to 2.0.33 (inclusive) 2.0.40 to 2.0.40 (inclusive) 2.0.57 to 2.0.57 (inclusive) 2.0.58 to 2.0.58 (inclusive) 2.0.59 to 2.0.59 (inclusive) 2.0.61 to 2.0.61 (inclusive) 2.0.63 to 2.0.63 (inclusive) 2.0.65 to 2.0.65 (inclusive) 2.0.66 to 2.0.66 (inclusive) 2.0.66.16 to 2.0.66.16 (inclusive) 2.0.66.17 to 2.0.66.17 (inclusive) 2.0.66.26 to 2.0.66.26 (inclusive) 2.0.66.27 to 2.0.66.27 (inclusive) 2.0.66.29 to 2.0.66.29 (inclusive) 2.0.66.31 to 2.0.66.31 (inclusive) 2.0.66.33 to 2.0.66.33 (inclusive) 2.0.71 to 2.0.71 (inclusive) 2.0.74 to 2.0.74 (inclusive) 2.0.76 to 2.0.76 (inclusive) 2.0.77 to 2.0.77 (inclusive) 2.0.78 to 2.0.78 (inclusive) 2.0.78.1 to 2.0.78.1 (inclusive) 2.0.79 to 2.0.79 (inclusive) 2.1.0 to 2.1.0 (inclusive) 2.1.2 to 2.1.2 (inclusive) 2.1.7 to 2.1.7 (inclusive) 2.1.9 to 2.1.9 (inclusive) 2.1.10 to 2.1.10 (inclusive)	`2.1.15`	September 12, 2017
CVE-2024-5442	Medium 5.9	0.4%	Before 3.59.3	`3.59.3`	July 13, 2024
CVE-2015-9537	Medium 5.4	1.2%	Before 2.1.10	`2.1.10`	November 26, 2019
CVE-2012-3414	Medium 6.1	9.1%	1.9.7 and earlier	`1.9.8`	June 14, 2012
CVE-2023-3279	Medium 4.9	0.8%	Before 3.39	`3.39`	October 16, 2023
CVE-2015-9229	Medium 4.8	1.0%	2.1.15 to 2.1.15 (inclusive)	`2.1.23`	September 12, 2017
CVE-2026-1463	High 8.8	0.5%	0 to 4.0.4 (inclusive)	`4.0.5`	March 18, 2026
CVE-2025-13641	High 8.8	0.7%	0 to 3.59.12 (inclusive)	`4.0.0`	December 18, 2025
CVE-2024-6393	Medium 4.8	0.5%	Before 3.59.5	`3.59.5`	November 25, 2024
CVE-2023-48328	High 8.8	0.3%	Before 3.39	`3.39`	November 30, 2023
WF-a67eb1fc-4762-4bdc-b0a0-c043c36659d0	High 8.8	—	3.1.5 and earlier	`3.1.6`	February 4, 2019
WF-47fb0513-bebe-4e09-9402-d7e174ee92ce	High 8.8	—	2.0.65 and earlier	`2.0.66`	May 20, 2014
CVE-2016-6565	High 7.5	2.5%	Before 2.1.57	`2.1.57`	July 13, 2018
CVE-2024-2744	Medium 4.3	0.4%	Before 3.59.1	`3.59.1`	May 17, 2024
CVE-2018-7586	High 7.5	2.0%	2.2.46 and earlier	`2.2.50`	March 1, 2018
WF-78fedd41-f0ab-4148-a798-88de62f27008	High 8.3	—	2.1.77 and earlier	`2.1.79`	February 17, 2017
CVE-2010-1186	Medium 6.1	4.7%	Before 1.5.2	`1.5.2`	April 6, 2010
CVE-2024-10545	Low 3.5	0.3%	Before 3.59.9	`3.59.9`	February 25, 2025
WF-cb855743-1d08-4e21-a23c-a4ffba615f57	High 7.5	—	2.0 and earlier	`2.0.7`	February 18, 2014
CVE-2026-28141	High 7.2	0.2%	4.2.3 and earlier	`4.2.4`	August 3, 2026
CVE-2024-5878	Medium 6.4	0.4%	0 to 2.14.4 (inclusive) 0 to 3.59.4 (inclusive)	`3.59.5`	May 20, 2025
WF-50589b41-cc2b-4ffa-ab63-509fb9d61be2	Medium 6.5	—	2.1.7 and earlier	`2.1.9`	August 28, 2015
CVE-2026-9059	Medium 4.9	0.3%	Before 4.2.1	`4.2.1`	May 20, 2026
CVE-2018-1000172	Medium 4.8	0.6%	2.2.44 and earlier	`2.2.45`	February 14, 2018
CVE-2008-7175	Medium 4.4	1.5%	1.9.0 and earlier	`1.9.1`	June 7, 2008
CVE-2024-39627	Medium 4.4	0.3%	3.59.3 and earlier	`3.59.4`	July 22, 2024
CVE-2026-6566	Medium 4.3	0.3%	0 to 4.2.0 (inclusive)	`4.2.1`	May 20, 2026
CVE-2022-38468	Medium 4.3	0.2%	Before 3.29	`3.29`	March 1, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.