4.3 Medium

CVE-2025-12377 The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized…

Description

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-level access and above, to perform multiple actions, such as removing images from arbitrary galleries. The vulnerability was partially patched in version 1.12.0.

Affected products and versions

Product	Affected versions	Fixed in
Gallery Plugin for WordPress – Envira Photo Gallery 1.12	earliest → 1.12.0	No fix stated
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More 1.12	earliest → 1.12.0	No fix stated

References

www.wordfence.com www.wordfence.com
drive.google.com drive.google.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
research.cleantalk.org research.cleantalk.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org

Timeline

Published November 13, 2025
Last modified April 8, 2026

The 4 CVEs of Gallery Plugin for WordPress – Envira Photo Gallery →

CVE-2025-11448 The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized… 4.3 Medium CVE-2024-5020 Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox… 6.4 Medium CVE-2023-6742 The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized… 4.3 Medium

Track this CVE