Now officially on WordPress.org

CVE Database / CVE-2026-9059

CVE

CVE-2026-9059 — Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] < 4.2.1

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-9059 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] < 4.2.1 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Unknown < 4.2.1 4.2.1 2026-05-20 —

CVE-2026-9059

Versions of NextGEN Gallery before 4.2.1 are susceptible to authenticated SQL injection attacks through the 'orderby' parameter in REST API endpoints for galleries and albums. The vulnerability stems from inadequate sanitization, specifically a character blacklist approach in '_clean_column()' within the data mapper layer, which permits an authenticated user with the 'NextGEN Gallery overview' capability (typically assigned to Administrators) to inject malicious SQL into sorting queries.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings