Vulnerabilities / Envira Gallery
Envira Gallery vulnerabilities
Advisories WPSec published for Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More. Other sources may list more. Its attack surface: Envira Gallery on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-08 | WPSEC-2026-0682 | Envira Gallery <= 1.16.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Private Post Title and Excerpt Disclosure via gallery_data REST Field | Medium 4.3 | 1.16.2 |
| 2026-10-08 | WPSEC-2026-0681 | Envira Gallery <= 1.16.1 - Authenticated (Contributor+) Sensitive Information Exposure of Private Galleries via Gallery Shortcode | Medium 4.3 | 1.16.2 |
| 2026-10-02 | WPSEC-2026-0350 | Envira Gallery <= 1.16.0 - Authenticated (Contributor+) Path Traversal to Image File Write via 'crop_position' Gallery Setting | Low 3.1 | 1.16.1 |
| 2026-10-02 | WPSEC-2026-0349 | Envira Gallery <= 1.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Configuration Values | Medium 6.4 | 1.16.1 |
License: CC BY 4.0