Plugin icon

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More

envira-gallery-lite

Vulnerabilities:

12

Last Updated:

April 23, 2026

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2026-05-13
Title
Envira Gallery < 1.12.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter
Fixed in
Fixed in 1.12.5
CVSS
5.5 (medium)
Published
2026-03-03
Title
Envira Gallery for WordPress < 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API
Fixed in
Fixed in 1.12.4
CVSS
5.5 (medium)
Published
2025-11-12
Title
Gallery Plugin for WordPress – Envira Photo Gallery < 1.12.1 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions
Fixed in
Fixed in 1.12.1
CVSS
4.3 (medium)
Published
2025-11-07
Title
Gallery Plugin for WordPress – Envira Photo Gallery < 1.12.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion
Fixed in
Fixed in 1.12.0
CVSS
4.3 (medium)
Published
2024-12-03
Title
Multiple Plugins - Contributor+ DOM-Based Stored XSS via FancyBox JavaScript Library
Fixed in
Fixed in 1.8.16
CVSS
5.9 (medium)
Published
2024-08-26
Title
Envira Photo Gallery < 1.8.15 - Missing Authorization
Fixed in
Fixed in 1.8.15
CVSS
4.3 (medium)
Published
2024-08-20
Title
Envira Gallery < 1.8.15 - Author+ Stored XSS
Fixed in
Fixed in 1.8.15
CVSS
5.9 (medium)
Published
2024-06-20
Title
Envira Photo Gallery < 1.8.8 - Cross-Site Request Forgery to Notice Dismissal
Fixed in
Fixed in 1.8.8
CVSS
4.3 (medium)
Published
2024-01-08
Title
Envira Gallery Lite < 1.8.7.3 - Missing Authorization to Gallery Modification via envira_gallery_insert_images
Fixed in
Fixed in 1.8.7.3
CVSS
4.3 (medium)
Published
2022-10-10
Title
Envira Gallery Lite < 1.8.4.7 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.8.4.7
CVSS
4.7 (medium)
Published
2020-12-19
Title
Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site Scripting
Fixed in
Fixed in 1.8.3.3
CVSS
5.5 (medium)
Published
2020-02-25
Title
Envira Photo Gallery < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS) Issue
Fixed in
Fixed in 1.7.7
CVSS
5.4 (medium)