Unknown Envira Gallery vulnerabilities

6 CVEs affecting Unknown Envira Gallery, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-104684, published 2026-10-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-104680, published 2026-10-11. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before…
CVE-2026-104653, published 2026-10-07. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute,…
CVE-2026-104652, published 2026-10-07. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above…
CVE-2026-104681, published 2026-10-11. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to…
CVE-2026-104684, published 2026-10-11. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public…
CVE-2026-104682, published 2026-10-11. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather…