CVE-2023-3279: Imagely NextGen Gallery

Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days.

The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks

Affected products

• Imagely NextGen Gallery: before 3.39 (fixed in 3.39)

Published 2023-10-16. Last modified 2026-06-17.