Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

85 Quality Score

Active Installs

25/30

An active install base of roughly 400,000 sites gives it very strong reach within the gallery category, though it trails MetaSlider and Smart Slider 3 in raw numbers.

Update Freshness

25/25

A last update on 2026-06-30 and a perfect 100/25 maintenance score shows the developer is actively shipping code, not just collecting fees.

User Rating

13/15

An 86/100 average across 4,338 reviews indicates broadly positive long-term user sentiment, not just early adopters.

Support Health

8/15

Only 15 of 28 (53.6%) support threads are marked resolved, which is the weakest signal in this report and suggests slower or less complete answers on the WordPress.org forum.

WP Compatibility

15/15

Tested up to WordPress 7.0 with a minimum requirement of 5.5.4 and PHP 7.0, earning full marks on compatibility with current and reasonably old environments.

Scores higher than 96% of indexed plugins

About

The most popular gallery plugin that lets you create galleries and albums in seconds.

Active Installs 300k+

Rating ★★★★ 4.3/5

Last Updated 2026-09-18 7:19pm GMT

Requires WordPress 5.5.4+

Tested Up To 7.1.1

Requires PHP 7.4+

Security History

49 known vulnerabilities, all patched

3 Critical 18 High 26 Medium 2 Low

Most recent: September 18, 2026

View details ▸

NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference Medium

September 18, 2026 Patched in ["4.5.0"] CVE-2026-81654

NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference Low

September 18, 2026 Patched in ["4.5.0"] CVE-2026-81651

NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference Low

September 18, 2026 Patched in ["4.5.0"] CVE-2026-81653

NextGEN Gallery <= 4.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference Medium

September 18, 2026 Patched in ["4.5.0"] CVE-2026-81652

NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload High

September 18, 2026 Patched in ["4.5.0"] CVE-2026-81650

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.2.3 - Unauthenticated Stored Cross-Site Scripting High

August 3, 2026 Patched in ["4.2.4"] CVE-2026-28141

Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection Medium

May 20, 2026 Patched in ["4.2.1"] CVE-2026-9059

Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API Medium

May 19, 2026 Patched in ["4.2.1"] CVE-2026-6566

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion High

March 17, 2026 Patched in ["4.0.5"] CVE-2026-1463

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template' High

December 17, 2025 Patched in ["4.0.0"] CVE-2025-13641

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library Medium

July 3, 2025 Patched in ["3.59.12"] CVE-2025-2537

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library Medium

May 19, 2025 Patched in ["3.59.5"] CVE-2024-5878

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

February 4, 2025 Patched in ["3.59.9"] CVE-2024-10545

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Medium

December 3, 2024 Patched in ["3.59.5"] CVE-2024-5020

NextGEN Gallery <= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

November 4, 2024 Patched in ["3.39.5"] CVE-2024-6393

NextGEN Gallery <= 3.59.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

July 22, 2024 Patched in ["3.59.4"] CVE-2024-39627

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery Medium

June 22, 2024 Patched in ["3.59.3"] CVE-2024-5442

Nextgen Gallery <= 3.59 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

April 26, 2024 Patched in ["3.59.1"] CVE-2024-2744

WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure Medium

April 5, 2024 Patched in ["3.59.1"] CVE-2024-3097

NextGEN Gallery <= 3.37 - Cross-Site Request Forgery Medium

November 23, 2023 Patched in ["3.39"] CVE-2023-48328

WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) Local File Inclusion Medium

September 25, 2023 Patched in ["3.39"] CVE-2023-3279

NextGEN Gallery <= 3.37 - Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit Medium

September 25, 2023 Patched in ["3.39"] CVE-2023-3155

WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) PHAR Deserialization High

September 25, 2023 Patched in ["3.39"] CVE-2023-3154

NextGEN Gallery <= 3.28 - Cross-Site Request Forgery leading to Post Thumbnail Change Medium

February 14, 2023 Patched in ["3.29"] CVE-2022-38468

WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery High

December 17, 2020 Patched in ["3.5.0"] CVE-2020-35942

WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery to Arbitrary File Upload High

December 17, 2020 Patched in ["3.5.0"] CVE-2020-35943

NextGEN Gallery <= 3.2.10 - SQL Injection Critical

August 27, 2019 Patched in ["3.2.11"] CVE-2019-14314

Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update High

February 25, 2019 Patched in ["3.1.7"]

NextGen Gallery <= 3.1.5 - PHP Object Injection High

February 4, 2019 Patched in ["3.1.6"]

WordPress Gallery Plugin – NextGEN Gallery <= 2.2.46 - Sensitive Information Disclosure High

March 2, 2018 Patched in ["2.2.50"] CVE-2018-7586

NextGEN Gallery <= 2.2.44 - Cross-Site Scripting via image alt and title text Medium

February 14, 2018 Patched in ["2.2.45"] CVE-2018-1000172

NextGen Gallery <= 2.1.77 - SQL Injection High

February 17, 2017 Patched in ["2.1.79"]

NextGEN Gallery <= 2.1.56 - Authenticated Local File Inclusion & SQL injection Critical

November 15, 2016 Patched in ["2.1.57"] CVE-2016-10889

NextGen Gallery <= 2.1.56 - Remote File Inclusion High

November 15, 2016 Patched in ["2.1.57"] CVE-2016-6565

NextGen Gallery <= 2.1.10 - Unrestricted File Upload High

December 23, 2015 Patched in ["2.1.15"] CVE-2015-9228

WordPress Gallery Plugin – NextGEN Gallery <= 2.1.15 - Authenticated (Admin+) Cross-Site Scripting Medium

September 14, 2015 Patched in ["2.1.23"] CVE-2015-9229

NextGen Gallery <= 2.1.9 - Cross-Site Scripting Medium

August 31, 2015 Patched in ["2.1.10"] CVE-2015-9537

NextGen Gallery <= 2.1.10 - Local File Inclusion Medium

August 28, 2015 Patched in ["2.1.15"] CVE-2015-9538

NextGen Gallery <= 2.1.7 - Path Traversal Medium

August 28, 2015 Patched in ["2.1.9"]

WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Cross-Site Request Forgery High

March 25, 2015 Patched in ["2.0.77.3"] CVE-2015-1784

WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Arbitrary File Upload High

March 25, 2015 Patched in ["2.0.77.3"] CVE-2015-1785

NextGen Gallery <= 2.0.65 - Arbitrary File Upload High

May 20, 2014 Patched in ["2.0.66"]

NextGen Gallery <= 2.0 - Path Traversal High

February 18, 2014 Patched in ["2.0.7"]

WordPress Gallery Plugin – NextGEN Gallery <= 1.9.12 - Arbitrary File Upload Critical

June 13, 2013 Patched in ["1.9.13"] CVE-2013-3684

WordPress Gallery Plugin – NextGEN Gallery 1.9.10 - 1.9.11 - Full Path Disclosure High

February 14, 2013 Patched in ["2.0.0"] CVE-2013-0291

SWFUpload <= 2.2.0.1 - Cross-Site Scripting Medium

November 9, 2012 Patched in ["1.9.7"] CVE-2012-3414

NextGen Gallery <= 1.9.7 - Cross-Site Scripting Medium

June 14, 2012 Patched in ["1.9.8"] CVE-2012-3414

WordPress Gallery Plugin – NextGEN Gallery <= 1.5.1 - Cross-Site Scripting Medium

April 6, 2010 Patched in ["1.5.2"] CVE-2010-1186

NextGEN Gallery Plugin <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

June 7, 2008 Patched in ["1.9.1"] CVE-2008-7175

What It Does

NextGEN Gallery lets you create image galleries, albums, and slideshows directly inside the WordPress admin, with batch uploading, tagging, and proofing (client approval) workflows built in. It ships with several gallery display templates (thumbnail, masonry, slideshow) and supports lightbox viewing. The free tier covers most basic needs, while paid add-ons unlock e-commerce, deeper styling, and the proofing feature.

Who It's For

This plugin is best for photographers, studios, and creative agencies that need to deliver client-proofing galleries or display large image collections on a WordPress site. It also suits hobbyist bloggers who want more control over gallery layouts than the default WP gallery offers. Non-technical users comfortable uploading and organizing hundreds of photos in batches will get the most out of it.

Who Should Skip It

If your site needs only a single image slider or carousel and nothing else, NextGEN is overkill and lightweight alternatives like MetaSlider or Smart Slider 3 will be easier to configure. Avoid it if you are unwilling to purchase paid extensions, because key features such as proofing, ecommerce prints, and premium gallery styles sit behind a paywall.

The Bottom Line

NextGEN Gallery remains a capable, actively maintained option for photographers and creative sites that need real gallery, album, and proofing features, with an 86.02/100 quality score that reflects both its strengths and its support gaps. The biggest caveats are that many best-in-class features are paid add-ons and that less than 54% of support threads on WordPress.org are marked resolved. Choose it for serious image workflows, not for a single simple slider.

Related Plugins

Photo Gallery by FooGallery 89/100

Pick FooGallery if you want a cleaner modern interface, strong free features, and easier theming without paying for extensions.

Smart Slider 3 89/100

Pick Smart Slider 3 if your priority is animated, visually polished sliders and carousels rather than proofing-style photo galleries.

Robo Gallery 87/100

Pick Robo Gallery if you want gallery and lightbox functionality in a lighter package and do not need NextGEN's albums and proofing tools.

MetaSlider 87/100

Pick MetaSlider if you primarily need a simple image or video slider with 500,000 installs and a famously easy setup workflow.

Firelight Lightbox 86/100

Pick Firelight Lightbox if all you really want is to open images in a lightbox and you would rather avoid a full gallery plugin.