CVE-2025-13641highCWE-98

CVE-2025-13641: high-severity vulnerability in smub Photo Gallery, Sliders, Proofing and…

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'

Published · Updated

Follow this CVE+ Monitor Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.8%
In short

The NextGEN Gallery WordPress plugin allows users with Contributor access or higher to include and run arbitrary PHP files on the server through a poorly validated 'template' parameter, potentially leading to unauthorized code execution.

Technical detail

Authenticated Local File Inclusion vulnerability in NextGEN Gallery <= 3.59.12 exploitable via the 'template' shortcode parameter due to insufficient path validation allowing absolute paths. Attackers with Contributor+ privileges can include arbitrary PHP files, bypassing server restrictions and achieving code execution within the WordPress context; RCE is possible if combined with file upload functionality.

Summary generated and translated by AI from the official description.
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter. This is due to insufficient path validation that allows absolute paths to be provided. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, bypassing web server restrictions like .htaccess. Successful exploitation could lead to information disclosure, code execution in the WordPress context, and potential remote code execution if combined with arbitrary file upload capabilities.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
smub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Related CVEs — smub Photo Gallery, Sliders, Proofing and…

In the same product, most dangerous first.

CVE-2024-3097MEDIUMWordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information DisclosureEPSS 38.0%CVE-2026-76012HIGHPhoto Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image UploadEPSS 0.8%CVE-2026-76010HIGHPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path TraversalEPSS 0.8%CVE-2026-1463HIGHPhoto Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File InclusionEPSS 0.5%CVE-2024-5020MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryEPSS 0.4%CVE-2024-5878MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript LibraryEPSS 0.4%