Essentialplugin Album and Image Gallery Plus Lightbox vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Essentialplugin Album and Image Gallery Plus Lightbox: 2 record(s), with affected versions and fixes.

CVE-2026-6443 Critical · 9.8 CWE-506 Apr 17, 2026

Essentialplugin WordPress Plugins: Embedded Backdoor (CWE-506)

All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.

CVE-2025-13612 Medium · 6.4 CWE-79 Feb 19, 2026

Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode

The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `aigpl-gallery-album` shortcode in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.