CVE-2023-3154: Imagely NextGen Gallery

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.

Affected products

• Imagely NextGen Gallery: before 3.39 (fixed in 3.39)

Published 2023-10-16. Last modified 2026-06-17.