Plugin icon

SimpLy Gallery

simply-gallery-block

Vulnerabilities:

11

Last Updated:

June 22, 2026

Active Installs:

40000

Published
Title
Fixed in
CVSS
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Fixed in
Fixed in 3.2.4.5
CVSS
7.1 (high)
Published
2026-03-23
Title
Mixed Media Gallery Blocks < 3.3.2.1 - Authenticated (Contributor+) Remote Code Execution
Fixed in
Fixed in 3.3.2.1
CVSS
7.2 (high)
Published
2025-12-12
Title
Gallery Blocks with Lightbox < 3.3.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification
Fixed in
Fixed in 3.3.1
CVSS
4.3 (medium)
Published
2025-10-26
Title
SimpLy Gallery < 3.3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.3.2.2
CVSS
5.5 (medium)
Published
2025-04-04
Title
Gallery Blocks with Lightbox < 3.2.6 - Contributor+ Stored XSS
Fixed in
Fixed in 3.2.6
CVSS
5.9 (medium)
Published
2024-11-21
Title
Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery < 3.2.4.3 - Authenticated (Editor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.2.4.3
CVSS
5.5 (medium)
Published
2024-06-27
Title
Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery < 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters
Fixed in
Fixed in 3.2.2
CVSS
6.4 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.1.5
CVSS
6.1 (medium)
Published
2023-03-06
Title
Gallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options Update
Fixed in
Fixed in 3.0.8
CVSS
8.8 (high)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 2.3.6
CVSS
4.3 (medium)
Published
2021-08-23
Title
Gallery Blocks with Lightbox < 2.2.1 - Authenticated Stored Cross-Site Scripting
Fixed in
Fixed in 2.2.1
CVSS
5.4 (medium)