Photo Gallery, Sliders, Proofing and Themes · Security record

Is Photo Gallery, Sliders, Proofing and Themes safe?

No known vulnerability affects the current version (4.5.5). 77 issues were found in earlier versions and fixed, the latest disclosed on Oct 30, 2026.

Checked 3 days ago against the WPVulnerability database, for version 4.5.5.

How it’s looked after

Last release: Oct 29, 2026 (1 week ago)
Releases in the last year: 25
Tested up to: WordPress 7.1.4
Support resolved: 15 of 18 threads in two months
Active installs: 300K+

77 known vulnerabilities

3 critical
15 high
20 medium
4 low
35 not rated

None affects the current version.

Disclosed each year

20081
20101
20121
20133
20143
201516
20163
20171
20182
20194
20202
20236
20246
20254
202613

Every known vulnerability in Photo Gallery, Sliders, Proofing and Themes

Newest first, with any that affect the current version at the top.

medium
Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML
Fixed in 4.5.5 · CVE-2026-116563 · Oct 30, 2026 · Wordfence
high
Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
Fixed in 4.5.0 · CVE-2026-76010 · Oct 30, 2026 · Wordfence
high
Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload
Fixed in 4.5.0 · CVE-2026-76012 · Oct 30, 2026 · Wordfence
high
Unauthenticated Arbitrary File Read
Fixed in 4.5.1 · CVE-2026-94123 · Sep 18, 2026 · Wordfence
high
Authenticated (Admin+) Arbitrary File Upload
Fixed in 4.5.0 · CVE-2026-81650 · Sep 18, 2026 · Wordfence
low
Authenticated (Admin+) Insecure Direct Object Reference
Fixed in 4.5.0 · CVE-2026-81651 · Sep 18, 2026 · Wordfence
low
Authenticated (Contributor+) Insecure Direct Object Reference
Fixed in 4.5.0 · CVE-2026-81652 · Sep 18, 2026 · Wordfence
medium
Authenticated (Admin+) Insecure Direct Object Reference
Fixed in 4.5.0 · CVE-2026-81653 · Sep 18, 2026 · Wordfence
low
Authenticated (Admin+) Insecure Direct Object Reference
Fixed in 4.5.0 · CVE-2026-81654 · Sep 18, 2026 · Wordfence
high
Unauthenticated Stored Cross-Site Scripting
Fixed in 4.2.4 · CVE-2026-28141 · May 20, 2026 · Wordfence
Authenticated (Admin+) SQL Injection
Fixed in 4.2.1 · CVE-2026-9059 · May 20, 2026 · Wordfence
medium
Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API
Fixed in 4.2.1 · CVE-2026-6566 · May 19, 2026 · Wordfence
Authenticated (Author+) Local File Inclusion
Fixed in 4.0.5 · CVE-2026-1463 · Mar 17, 2026 · Wordfence
high
Authenticated (Contributor+) Local File Inclusion via 'template'
Fixed in 4.0.0 · CVE-2025-13641 · Dec 17, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
Fixed in 3.59.12 · CVE-2025-2537 · Jul 3, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library
Fixed in 3.59.5 · CVE-2024-5878 · May 19, 2025 · Wordfence
low
Authenticated (Admin+) Stored Cross-Site Scripting
Fixed in 3.59.9 · CVE-2024-10545 · Feb 4, 2025 · Wordfence
medium
Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
Fixed in 3.59.5 · CVE-2024-5020 · Dec 3, 2024 · Wordfence
medium
Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in 3.59.5 · CVE-2024-6393 · Nov 4, 2024 · Wordfence
medium
Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in 3.59.4 · CVE-2024-39627 · Jul 22, 2024 · Wordfence
medium
Authenticated (Admin+) Stored Cross-Site Scripting via Gallery
Fixed in 3.59.3 · CVE-2024-5442 · Jun 22, 2024 · Wordfence
medium
Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in 3.59.1 · CVE-2024-2744 · Apr 26, 2024 · Wordfence
medium
Missing Authorization to Unauthenticated Information Disclosure
Fixed in 3.59.1 · CVE-2024-3097 · Apr 5, 2024 · Wordfence
medium
Cross-Site Request Forgery
Fixed in 3.39 · CVE-2023-48328 · Nov 23, 2023 · Wordfence
medium
Authenticated (Admin+) Local File Inclusion
Fixed in 3.39 · CVE-2023-3279 · Sep 25, 2023 · Wordfence
high
Authenticated (Admin+) PHAR Deserialization
Fixed in 3.39 · CVE-2023-3154 · Sep 25, 2023 · Wordfence
high
Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit
Fixed in 3.39 · CVE-2023-3155 · Sep 25, 2023 · Wordfence
high
Reflected Cross-Site Scripting
Fixed in 3.4.7 · CVE-2023-33999 · Jul 18, 2023 · WPScan
medium
Cross-Site Request Forgery leading to Post Thumbnail Change
Fixed in 3.29 · CVE-2022-38468 · Feb 14, 2023 · Wordfence
medium
Cross-Site Request Forgery to Arbitrary File Upload
Fixed in 3.5.0 · CVE-2020-35943 · Dec 17, 2020 · Wordfence
high
Cross-Site Request Forgery
Fixed in 3.5.0 · CVE-2020-35942 · Dec 17, 2020 · Wordfence
critical
SQL Injection
Fixed in 3.2.11 · CVE-2019-14314 · Aug 27, 2019 · Wordfence
Authenticated Option Update vulnerability (Fremius Library security issue)
Fixed in 3.1.7 · Mar 2, 2019 · Patchstack
Missing Authorization to Arbitrary Options Update
Fixed in 3.1.7 · Feb 25, 2019 · Wordfence
PHP Object Injection
Fixed in 3.1.6 · Feb 4, 2019 · Wordfence
high
Sensitive Information Disclosure
Fixed in 2.2.50 · CVE-2018-7586 · Mar 1, 2018 · Wordfence
medium
Cross-Site Scripting via image alt and title text
Fixed in 2.2.45 · CVE-2018-1000172 · Feb 14, 2018 · Wordfence
SQL Injection
Fixed in 2.1.79 · Feb 17, 2017 · Wordfence
Authenticated Remote Code Execution (RCE) Vulnerability
Fixed in 2.1.60 · Nov 28, 2016 · Patchstack
high
Remote File Inclusion
Fixed in 2.1.57 · CVE-2016-6565 · Nov 15, 2016 · Wordfence
critical
Authenticated Local File Inclusion & SQL injection
Fixed in 2.1.57 · CVE-2016-10889 · Nov 15, 2016 · Wordfence
high
Unrestricted File Upload
Fixed in 2.1.15 · CVE-2015-9228 · Dec 23, 2015 · Wordfence
Authenticated Path Traversal
Fixed in 2.1.9 · Oct 7, 2015 · Patchstack
medium
Authenticated (Admin+) Cross-Site Scripting
Fixed in 2.1.23 · CVE-2015-9229 · Sep 14, 2015 · Wordfence
medium
Cross-Site Scripting
Fixed in 2.1.10 · CVE-2015-9537 · Aug 31, 2015 · Wordfence
Path Traversal
Fixed in 2.1.9 · Aug 28, 2015 · Wordfence
medium
Local File Inclusion
Fixed in 2.1.15 · CVE-2015-9538 · Aug 28, 2015 · Wordfence
Full Path Disclosure
Fixed in 1.7.4 · May 15, 2015 · Patchstack
Multiple Vulnerabilities
Fixed in 1.8.4 · May 15, 2015 · Patchstack
Multiple XSS
Fixed in 1.9.1 · May 15, 2015 · Patchstack
Stored XSS
Fixed in 2.0.0 · May 15, 2015 · Patchstack
Full Path Disclosure
Fixed in 2.0.0 · May 15, 2015 · Patchstack
Cross Site Scripting
Fixed in 1.9.8 · May 15, 2015 · Patchstack
Directory Traversal
Fixed in 2.0.7 · May 15, 2015 · Patchstack
Arbitrary File Upload
Fixed in 2.0.66 · May 15, 2015 · Patchstack
medium
Arbitrary File Upload
Fixed in 2.0.77.3 · CVE-2015-1785 · Mar 25, 2015 · Wordfence
high
Cross-Site Request Forgery
Fixed in 2.0.77.3 · CVE-2015-1784 · Mar 25, 2015 · Wordfence
Arbitrary File Upload
Fixed in 2.0.66 · May 20, 2014 · Wordfence
Directory Traversal
Fixed in 2.0.1 · Feb 19, 2014 · Patchstack
Path Traversal
Fixed in 2.0.7 · Feb 18, 2014 · Wordfence
critical
Arbitrary File Upload
Fixed in 1.9.13 · CVE-2013-3684 · Jun 12, 2013 · Wordfence
high
Full Path Disclosure
Affects 1.9.11 and earlier · CVE-2013-0291 · Feb 14, 2013 · Wordfence
Cross Site Scripting
Fixed in 1.9.11 · Jan 8, 2013 · Patchstack
Cross-Site Scripting
Fixed in 1.9.7 · CVE-2012-3414 · Jun 14, 2012 · Wordfence
Cross-Site Scripting
Fixed in 1.5.2 · CVE-2010-1186 · Apr 6, 2010 · Wordfence
Authenticated (Admin+) Stored Cross-Site Scripting
Affects 0.96 and earlier · CVE-2008-7175 · Jun 7, 2008 · Wordfence
Arbitrary File Upload
Fixed in 2.0.66 · WPScan
Directory Traversal
Fixed in 2.0.7 · WPScan
Multiple Cross-Site Scripting (XSS)
Fixed in 1.9.1 · WPScan
XXS & CSRF
Fixed in 1.8.4 · WPScan
swfupload.swf Cross-Site Scripting (XSS)
Fixed in 1.9.8 · WPScan
xml/ajax.php Path Disclosure
Fixed in 1.7.4 · WPScan
gallerypath Parameter Stored XSS
Fixed in 2.0.0 · WPScan
Authenticated Path Traversal
Fixed in 2.1.9 · WPScan
Unauthenticated SQL Injection
Fixed in 2.1.79 · WPScan
Authenticated PHP Object Injection
Fixed in 3.1.6 · WPScan
Subscriber+ Arbitrary Option Update
Fixed in 3.1.7 · WPScan

Questions about Photo Gallery, Sliders, Proofing and Themes’s security

Is Photo Gallery, Sliders, Proofing and Themes safe to use?

No known vulnerability affects its current version. Earlier versions had issues that are now fixed, so keep Photo Gallery, Sliders, Proofing and Themes updated: most attacks target sites that haven’t updated.

Does Photo Gallery, Sliders, Proofing and Themes have known security vulnerabilities?

None that affect the current version. WPVulnerability’s database lists 77 older issues, fixed in earlier versions, so keep Photo Gallery, Sliders, Proofing and Themes up to date.

Is Photo Gallery, Sliders, Proofing and Themes still maintained?

Yes. Its last release was 1 week ago. Its authors resolved 15 of the 18 support threads opened in the last two months.

Is Photo Gallery, Sliders, Proofing and Themes compatible with the latest WordPress?

Yes. It’s tested up to WordPress 7.1.4, the current version.

Hear about the next one first

Track your plugin on TrackWP and get an alert when a new vulnerability affecting it is published. Every plan has it, the free Starter too; Boost and FullCharge email it at once.

Start free

Vulnerability data from WPVulnerability (CC0), which gathers records from CVE, Wordfence, Patchstack and WPScan. A clean record isn’t a guarantee: keep every plugin updated.