Is Envira Gallery safe?

Every recorded flaw

• Oct 11, 2026Envira Gallery: Does not verify that a user is authorized to read a gallery before rendering itCVE-2026-104684 · fixed in 1.16.2 · reported by WPScanLow 2.7
• Oct 11, 2026Envira Gallery: Does not correctly check authorization on its gallery-conversion featureCVE-2026-104682 · fixed in 1.16.2 · reported by WPScanLow 2.7
• Oct 11, 2026Envira Gallery: Does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to viewCVE-2026-104681 · fixed in 1.16.2 · reported by WPScanLow 2.7
• Oct 11, 2026Envira Gallery: Does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1CVE-2026-104680 · fixed in 1.16.2 · reported by WPScanHigh 7.2
• Oct 9, 2026its gallery conversion REST endpoint that: Envira Gallery Lite before 1.16.2 contains a missing authorizationCVE-2026-104079 · fixed in 1.16.2 · reported by VulnCheckMedium 5.3
• Oct 7, 2026Envira Gallery: Does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attributeCVE-2026-104653 · fixed in 1.16.1 · reported by WPScanMedium 6.8
• Oct 7, 2026Envira Gallery: Does not sanitise and escape a gallery item identifier before outputting it in an image tag attributeCVE-2026-104652 · fixed in 1.16.1 · reported by WPScanMedium 6.8
• Aug 28, 2026Envira Gallery: Stored Cross-Site ScriptingCVE-2026-3423 · affects up to 1.12.4 · reported by WordfenceMedium 6.4
• Jun 16, 2026Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.CVE-2026-54190 · affects up to 1.12.5 · reported by PatchstackMedium 6.5
• May 14, 2026Envira Gallery Lite: Stored Cross-Site ScriptingCVE-2026-5361 · affects up to 1.12.4 · reported by WordfenceMedium 6.4
• Mar 4, 2026Envira Gallery for: Stored Cross-Site ScriptingCVE-2026-1236 · affects up to 1.12.3 · reported by WordfenceMedium 6.4
• Nov 13, 2025Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2025-12377 · affects up to 1.12.0 · reported by WordfenceMedium 4.3
• Nov 8, 2025Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2025-11448 · affects up to 1.11.0 · reported by WordfenceMedium 4.3
• Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-43925 · affects up to 1.8.14 · reported by PatchstackMedium 4.3
• Nov 1, 2024Envira Photo Gallery: Missing AuthorizationCVE-2024-37095 · affects up to 1.8.7.3 · reported by PatchstackMedium 4.3
• Jan 11, 2024Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2023-6742 · affects up to 1.8.7.1 · reported by WordfenceMedium 4.3
• Oct 31, 2022Gallery Plugin for: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2190 · fixed in 1.8.4.7 · reported by WPScanMedium 6.1
• Mar 18, 2021Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadatCVE-2021-24126 · fixed in 1.8.3.3 · reported by WPScanMedium 5.4
• Feb 25, 2020A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress.CVE-2020-9334 · affects up to 1.7.6 · reported by MITREMedium 5.4

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.