CVE-2013-5962: Envato Complete Gallery Manager Plugin

Medium severity, CVSS 5.1. EPSS: 14.8% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/[year]/[month]/.

Affected products

• Envato Complete Gallery Manager Plugin: up to and including 3.3.3; version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 2.0.0 only; version 2.0.1 only; …

Published 2013-09-30. Last modified 2026-06-16.