← back to popular plugins
wordfence / plugin · simply-gallery-block
Mixed Media Gallery Blocks
simply-gallery-block
total installs
40,000
total vulns
4
critical
0
high
1
medium
3
low
0
latest vuln
—
patched
4
unpatched
0
avg time to patch
—
vulnerabilities
(4)
Mixed Media Gallery Blocks <= 3.3.2 - Authenticated (Contributor+) Remote Code Execution
high
✓ patched
cve id
CVE-2026-25345 ↗
cvss score
8.8
cwe
CWE-94: Improper Control of Generation of Code ('Code Injection')
published
Mar 23, 2026
The Mixed Media Gallery Blocks plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Gallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification
medium
✓ patched
The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to unauthorized modification of plugin settings in all versions up to, and including, 3.3.0. This is due to the plugin using the `edit_posts` capability check instead of `manage_options` for the `update_option` action type in the `pgc_sgb_action_wizard` AJAX handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify arbitrary plugin settings prefixed with `pgc_sgb_*`.
SimpLy Gallery <= 3.3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
✓ patched
cve id
CVE-2025-63052 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Oct 26, 2025
The SimpLy Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Gallery Blocks with Lightbox <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
✓ patched
cve id
CVE-2025-32176 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Apr 4, 2025
The Gallery Blocks with Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.