CVE-2016-6565

CVE-2016-6565: The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious file

Vendor Imagely

Product NextGen Gallery plugin

Weakness CWE-98 · PHP file inclusion

Published July 13, 2018

Last update August 6, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).

Key dates

02Disclosure timeline

July 13, 2018 CVE published

August 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2016-6565 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/98.html

Related vulnerabilities

04Related CVE

CVE-2025-49276 WordPress Blogmine theme <= 1.1.7 - Local File Inclusion Vulnerability CVE-2025-12549 WordPress Rozy - Flower Shop theme <= 1.2.25 - Local File Inclusion vulnerability CVE-2025-68062 WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability CVE-2024-54270 WordPress Axeptio plugin <= 2.5.4 - Local File Inclusion vulnerability CVE-2025-30849 WordPress Essential Real Estate plugin <= 5.2.0 - Local File Inclusion Vulnerability