Photo Gallery, Sliders, Proofing And Themes
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:photo_gallery,_sliders,_proofing_and_themes:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Photo Gallery, Sliders, Proofing And Themes (cda8b983-f574-54e7-b36e-7d7f12a5a8e4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-81651 |
vulnerable | 2026-10-13 12:28:37.146127 |
NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.
Published: 2026-09-20T06:00:15.803Z
Updated: 2026-09-20T13:47:51.421Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-81654 |
vulnerable | 2026-10-13 12:28:36.975776 |
NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
Published: 2026-09-20T06:00:16.342Z
Updated: 2026-09-20T13:48:37.707Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-81650 |
vulnerable | 2026-10-13 12:28:36.942960 |
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.
Published: 2026-09-20T06:00:15.631Z
Updated: 2026-09-20T13:46:51.624Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-81652 |
vulnerable | 2026-10-13 12:28:36.779930 |
NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.
Published: 2026-09-20T06:00:15.977Z
Updated: 2026-09-20T13:48:07.751Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-81653 |
vulnerable | 2026-10-13 12:28:36.714703 |
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.
Published: 2026-09-20T06:00:16.158Z
Updated: 2026-09-20T13:48:45.933Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6393 |
vulnerable | 2026-06-08 06:58:19.328862 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5442 |
vulnerable | 2026-06-08 06:56:16.037121 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10545 |
vulnerable | 2026-06-08 06:23:46.917065 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.