SZB-9ea4741ab6
EUVD-2026-114236: NextGEN Gallery plugin remote code execution reported via legacy_render
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- smub
- Product
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
- First seen
Summary
The EUVD listing (CVSS 7.5) says the Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery WordPress plugin is vulnerable to remote code execution in all versions up to and including 4.4.1 via the legacy_render function. The listing is the only source cited.
If you use smub
Update the NextGEN Gallery plugin to a version later than 4.4.1
Disable the plugin if an update is not yet available
Review the site for unexpected files or admin accounts
What the sources say 1
· Mastodon: “The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function.” Source