Envira Gallery (Unknown) - vulnerabilities (CVEs)

6 CVEs, 6 in the last 30 days, 1 known versions, newest CVE from 2026-10-11. Vendor: Unknown.

CVEs of Envira Gallery

• CVE-2026-104681 - CVSS 2.7 (low), 2026-10-11: The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is…
• CVE-2026-104680 - CVSS 7.2 (high), 2026-10-11: The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress…
• CVE-2026-104684 - CVSS 2.7 (low), 2026-10-11: The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed…
• CVE-2026-104682 - CVSS 2.7 (low), 2026-10-11: The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can…
• CVE-2026-104653 - CVSS 6.8 (medium), 2026-10-07: The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and…
• CVE-2026-104652 - CVSS 6.8 (medium), 2026-10-07: The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute,…