← WordPress Vulnerabilities
WordPress security by component

Gallery

Gallery is a WordPress component with 7 published CVE records in this archive. The latest tracked vulnerability was published Nov 08, 2025; the highest CVE/CNA score is 9.8.

Plugin slug: gallery

CVE-2025-11448: Gallery: A security weakness

Gallery is affected by a security weakness. Exploitation requires at least contributor-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.

PublishedNov 08, 2025
Safe version guidanceSee mitigation notes
Safe version
Nov 08, 2025 CVE-2025-11448
Gallery: A security weakness
Gallery is affected by a security weakness. Exploitation requires at least contributor-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVDPending
Feb 17, 2025 CVE-2025-26778
Gallery: Cross-site scripting
Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE5.9
NVDPending
Jan 02, 2025 CVE-2023-45631
Responsive Image Gallery, Gallery Album: A security weakness
Responsive Image Gallery, Gallery Album is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVD5.4
Apr 17, 2023 CVE-2023-0765
Gallery by BestWebSoft: SQL injection
Gallery by BestWebSoft is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE8.8
NVD8.8
Apr 17, 2023 CVE-2023-0764
Gallery by BestWebSoft: A security weakness
Gallery by BestWebSoft is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.4
NVD5.4
Jul 04, 2022 CVE-2022-1946
Gallery: Cross-site scripting
Gallery is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
Jan 22, 2020 CVE-2012-4919
Gallery: A security weakness
Gallery is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE9.8
NVD9.8