Photo Gallery, Sliders, Proofing and Themes vulnerability: is your WooCommerce store affected?

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

1. Code execution

   Someone could run their own code on your server.

   Score 8.8 (high)needs only a customer accountAffected: older than 4.5.0Fixed in 4.5.0Published 30 October 2026CVE-2026-76010

   Advisory: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function.

2. Code execution

   Someone could run their own code on your server.

   Score 7.5 (high)needs only a customer accountAffected: older than 4.5.0Fixed in 4.5.0Published 30 October 2026CVE-2026-76012

   Advisory: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function.

3. File access

   Someone could read files on your server they should never see.

   Score 7.5 (high)no login neededAffected: older than 4.5.1Fixed in 4.5.1Published 18 September 2026CVE-2026-94123

   Advisory: Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

4. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.1 (high)no login neededAffected: older than 4.2.4Fixed in 4.2.4Published 20 May 2026CVE-2026-28141

   Advisory: Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

5. File inclusion

   Someone could make the plugin load files it shouldn't, which can expose data or run code.

   Score 8.8 (high)needs only a customer accountAffected: older than 4.0.0Fixed in 4.0.0Published 17 December 2025CVE-2025-13641

   Advisory: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter.

6. PHP object injection

   In some setups, someone could make your server run code.

   Score 7.5 (high)no login neededAffected: older than 3.39Fixed in 3.39Published 25 September 20236208e90162a75e1fd094b0db37e6f0c0901fbb72

   Advisory: The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 3.38 via deserialization of untrusted input in the gallery_edit function.

7. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.1 (high)no login neededAffected: older than 3.4.7Fixed in 3.4.7Published 18 July 2023c91b66be60f093a315c22e0b567c6164008a2a49

8 older holes, published before 1 January 2023

1. Code execution

   Someone could run their own code on your server.

   Score 8.8 (high)no login neededAffected: older than 3.5.0Fixed in 3.5.0Published 17 December 2020CVE-2020-35942

   Advisory: A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It...

2. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 9.8 (critical)no login neededAffected: older than 3.2.11Fixed in 3.2.11Published 27 August 2019CVE-2019-14314

   Advisory: A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.

3. File access

   Someone could read files on your server they should never see.

   Score 7.5 (high)no login neededAffected: older than 2.2.50Fixed in 2.2.50Published 1 March 2018CVE-2018-7586

   Advisory: In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.

4. SQL injection

   Someone could read or change your database, which holds customer and order details.

   Score 9.8 (critical)no login neededAffected: older than 2.1.57Fixed in 2.1.57Published 15 November 2016CVE-2016-10889

   Advisory: The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.

5. File access

   Someone could read files on your server they should never see.

   Score 7.5 (high)needs only a customer accountAffected: older than 2.1.57Fixed in 2.1.57Published 15 November 2016CVE-2016-6565

   Advisory: The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary...

6. File upload

   Someone could upload files to your server, which can include code.

   Score 8.8 (high)needs only a customer accountAffected: older than 2.1.15Fixed in 2.1.15Published 23 December 2015CVE-2015-9228

   Advisory: In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php.

7. Cross-site request forgery

   Someone could trick a logged-in admin into making a change.

   Score 8.8 (high)needs only a customer accountAffected: older than 2.0.77.3Fixed in 2.0.77.3Published 25 March 20155a5021889668720e40775358747f70819e108b39

   Advisory: In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application.

8. File upload

   Someone could upload files to your server, which can include code.

   Score 9.8 (critical)no login neededAffected: older than 1.9.13Fixed in 1.9.13Published 12 June 2013CVE-2013-3684

   Advisory: NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload

How to check your version

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find Photo Gallery, Sliders, Proofing and Themes. The version number is under its name. If it is lower than 4.5.1, your store is affected.
3. No login to hand? Open https://yourstore.com/wp-content/plugins/nextgen-gallery/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
2. On the copy, update Photo Gallery, Sliders, Proofing and Themes to 4.5.1 or newer: Dashboard > Updates, or Update now on the Plugins page.
3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use Photo Gallery, Sliders, Proofing and Themes.
5. If everything works, make the same update on the live store and place one more test order.
6. If you no longer use Photo Gallery, Sliders, Proofing and Themes, delete it instead of leaving it deactivated.

Questions

Which Photo Gallery, Sliders, Proofing and Themes version fixes it?

Version 4.5.1 or newer fixes all 15 issues on this page.

How do I know if my store is affected?

Your store is affected if it runs Photo Gallery, Sliders, Proofing and Themes older than 4.5.1. In WordPress, open Plugins and read the version under Photo Gallery, Sliders, Proofing and Themes. Without logging in, open yourstore.com/wp-content/plugins/nextgen-gallery/readme.txt and read the Stable tag line.

I don't use Photo Gallery, Sliders, Proofing and Themes any more. Is a deactivated copy safe?

Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.

Can someone fix it for me?

Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 5 November 2026.