Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

1296 searches this plugin appeared in over the last 90 days, 20 listed. 1156 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 3 months ago and the previous band took 20 months to cross, so the real count is still just under 400K.

1. ★★★★★ airkagi

   4mo ago

   I think this is a must-have product. I’ve been using it since around 2018, and it has improved tremendously over the years. I especially love the new interface and the photo management system. Uploading photos is now much faster and easier, making my workflow much more efficient. I came from building websites with HTML before switching to WordPress, so I really appreciate everything this software automates. For me, it’s been a game changer. If you’ve always used WordPress, you may take some of these features for granted, but coming from a more manual workflow, I can truly appreciate how much time it saves. This has become one of my favorite programs because it has stood the test of time. It continues to improve with every update, and I rely on it regularly. I highly recommend it to anyone looking for a reliable, well-supported platform. — ThePhotoGuy.us

   Read on wp.org ↗
2. ★★★★★ scratchy101

   5mo ago

   This is actually a downgrade as the whole look and feel of Nexgen is gone. Managing Albums now truncates the names of the Galleries shown in a grid, instead of the full names in a list in Nexgen. Many users are reporting problems with this update, such as HTML links in descriptions are now broken as well as back-end editing of albums and galleries.

   Read on wp.org ↗
3. ★★★★★ webweaverToo

   6mo ago

   I have been using NextGEN gallery since 2011. It’s been a brilliant plugin. Having just installed the latest version on a new website I’m building, all I can say is DO NOT “UPGRADE” TO v4. It’s awful – horrible new interface (which I guess you could get used to) but much worse – I could not get it to work on my WP build at all. It just would not show any galleries on the “Manage galleries” page, however many new test galleries I made and however many times I refreshed. Useless. Fortunately I found a post in the forums that told me to go to plugins > nextgen-gallery > advanced Scroll to the bottom of that page where you’ll see Previous Versions where you can download v3.59.12. I have uninstalled v4 and installed v3.59.12 instead, which works fine. Phew. I’ll never be “upgrading” to v4, that’s for sure.

   Read on wp.org ↗
4. ★★★★★ oleg5korolevskiy

   8mo ago

   Спасибо создателю этого плагина за старую версию.

   Read on wp.org ↗
5. ★★★★★ gahlii

   8mo ago

   I’ve been using NextGEN Galleries for a long time across multiple websites and I have over 300 Galleries. It was always my first choice for albums and galleries. But since v4, everything has changed — and not in a good way. For the last 2–3 weeks I’ve been really dissatisfied. At first I assumed it would get fixed quickly, but it hasn’t. Instead, it’s been incredibly frustrating to use. I’m constantly running into error messages, and it features were removed without any clear announcement or proper transition. I can’t recommend this plugin to anyone. It’s a shame, because it used to be reliable — but v4 has been a major step backwards.

   Read on wp.org ↗
6. ★★★★★ bobwey1

   9mo ago

   We have used NextGEN Gallery for years. Website has 50 galleries, with over 4500 images. Whenever there’s been a problem, Supoort has responded promptly, with resolution and/or suggestions. Haven’t switched from NextGEN to Imagely because I’m comfortable with the NextGEN format and feel that Imagely is too drastic a change.

   Read on wp.org ↗
7. ★★★★★ tinuzz

   10mo ago

   I’m a long time Nextgen gallery user, so the latest major update under the Imagely brand came as quite the shock. Generally, the esthetic changes aren’t bad, but it’s pretty buggy and important functionality has been removed. I’m not going to list all the problems here, but if things do not improve over the next couple of updates, I’m seriously going to look for alternatives.

   Read on wp.org ↗
8. ★★★★★ macsuibhne

   10mo ago

   Despite some flaws this used to be a good plugin. However, since the 4.0 update it’s pretty much unusable. Just have a look through the support pages and you’ll see absolutely no response from the developers and anything critical is being deleted completely. The plugin is hugely buggy now. Some of the most basic things you’d expect to find in a gallery plugin are missing, like being able to set maximum dimensions and quality. Any photo you upload to the free version now are saved and displayed at their original resolution. And that’s just one example! I’ve been using NextGen for close to a decade and I’ve even bought the pro version multiple times but now it’s time to move on. About 5 years ago I contacted support about a problem with displaying galleries. The reply was that it was a known issue and was to be fixed in the near future. 5 years later and it still hasn’t been fixed. So do I expect the absolute catastrophe of the 4.0 update to be fixed? Not a chance!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.2.2 Added: Google Photos integration — import images directly from your Google Photos account into NextGEN galleries. Added: Dropbox integration — import images from Dropbox into NextGEN galleries. 4.2.2
2. — Version 4.2.1 Fixed: Security hardening across the plugin to better protect site data and reinforce permission checks. We recommend updating. Fixed: Edit Image crop tool now uses the correct aspect ratio from your gallery’s thumbnail 4.2.1
3. — Version 4.2.0 Fixed: Publishing galleries and albums from the Imagely Lightroom plugin could fail with a generic processing error after a recent update Fixed: Albums created by Imagely Lightroom could appear empty on the front end wit 4.2.0
4. — Version 4.1.3 Fixed: Imagely admin no longer hammered the REST API with repeated settings requests when browsing Galleries and Albums (column visibility auto-save). 4.1.3
5. — Version 4.1.2 Added: Duplicate pricelists individually or in bulk from the Ecommerce tab with confirmation modal Added: Column visibility on “Manage Galleries” and “Manage Albums” tables is now saved and restored when returning to the 4.1.2
6. — Version 4.1.1 Fixed: PNG and WEBP watermarks no longer lose transparency when applied to images Fixed: Fatal error when using NextGen Gallery with older Pro add-on versions that reference the legacy C_NextGen_Settings class Fixed: Sin 4.1.1

All 53 disclosed vulnerabilities are patched in the current version (4.5.5). Sites still on an older version should update.

1. Patched High · 8.8 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal ↗
   2026-10-30 CVE-2026-76010 Unrestricted Upload of File with Dangerous Type Affects <= 4.4.1 Patched in 4.5.0
2. Patched Medium · 5.4 Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML ↗
   2026-10-30 CVE-2026-116563 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.4 Patched in 4.5.5
3. Patched High · 7.5 Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload ↗
   2026-10-30 CVE-2026-76012 Unrestricted Upload of File with Dangerous Type Affects <= 4.4.1 Patched in 4.5.0
4. Patched High · 7.5 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.0 - Unauthenticated Arbitrary File Read ↗
   2026-09-24 CVE-2026-94123 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.5.0 Patched in 4.5.1
5. Patched Medium · 4.3 NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference ↗
   2026-09-18 CVE-2026-81654 Authorization Bypass Through User-Controlled Key Affects <= 4.4.0 Patched in 4.5.0
6. Patched Low · 2.7 NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference ↗
   2026-09-18 CVE-2026-81651 Authorization Bypass Through User-Controlled Key Affects <= 4.4.0 Patched in 4.5.0
7. Patched Low · 2.7 NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference ↗
   2026-09-18 CVE-2026-81653 Authorization Bypass Through User-Controlled Key Affects <= 4.4.0 Patched in 4.5.0
8. Patched Medium · 4.3 NextGEN Gallery <= 4.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference ↗
   2026-09-18 CVE-2026-81652 Authorization Bypass Through User-Controlled Key Affects <= 4.4.0 Patched in 4.5.0
9. Patched High · 7.2 NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload ↗
   2026-09-18 CVE-2026-81650 Unrestricted Upload of File with Dangerous Type Affects <= 4.4.0 Patched in 4.5.0
10. Patched High · 7.2 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.2.3 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-08-03 CVE-2026-28141 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.3 Patched in 4.2.4
11. Patched Medium · 4.9 Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection ↗
    2026-05-20 CVE-2026-9059 Improper Neutralization of Special Elements used in an SQL Command Affects < 4.2.1 Patched in 4.2.1
12. Patched Medium · 4.3 Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API ↗
    2026-05-19 CVE-2026-6566 Authorization Bypass Through User-Controlled Key Affects <= 4.2.0 Patched in 4.2.1
13. Patched High · 8.8 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion ↗
    2026-03-17 CVE-2026-1463 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 4.0.4 Patched in 4.0.5
14. Patched High · 8.8 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template' ↗
    2025-12-17 CVE-2025-13641 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 3.59.12 Patched in 4.0.0
15. Patched Medium · 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library ↗
    2025-07-03 CVE-2025-2537 Improper Neutralization of Input During Web Page Generation Affects <= 3.59.11 Patched in 3.59.12
16. Patched Medium · 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library ↗
    2025-05-19 CVE-2024-5878 Improper Neutralization of Input During Web Page Generation Affects <= 3.59.4 Patched in 3.59.5
17. Patched Medium · 4.4 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-02-04 CVE-2024-10545 Improper Neutralization of Input During Web Page Generation Affects <= 3.59.8 Patched in 3.59.9
18. Patched Medium · 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library ↗
    2024-12-03 CVE-2024-5020 Improper Neutralization of Input During Web Page Generation Affects <= 3.59.4 Patched in 3.59.5
19. Patched Medium · 4.4 NextGEN Gallery <= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-11-04 CVE-2024-6393 Improper Neutralization of Input During Web Page Generation Affects <= 3.39.4 Patched in 3.39.5
20. Patched Medium · 4.4 NextGEN Gallery <= 3.59.3 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-07-22 CVE-2024-39627 Improper Neutralization of Input During Web Page Generation Affects <= 3.59.3 Patched in 3.59.4
21. Patched Medium · 4.4 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery ↗
    2024-06-22 CVE-2024-5442 Improper Neutralization of Input During Web Page Generation Affects <= 3.59.2 Patched in 3.59.3
22. Patched Medium · 4.4 Nextgen Gallery <= 3.59 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-04-26 CVE-2024-2744 Improper Neutralization of Input During Web Page Generation Affects <= 3.59 Patched in 3.59.1
23. Patched Medium · 5.3 WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure ↗
    2024-04-05 CVE-2024-3097 Missing Authorization Affects <= 3.59 Patched in 3.59.1
24. Patched Medium · 4.3 NextGEN Gallery <= 3.37 - Cross-Site Request Forgery ↗
    2023-11-23 CVE-2023-48328 Cross-Site Request Forgery Affects <= 3.37 Patched in 3.39
25. Patched Medium · 4.9 WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) Local File Inclusion ↗
    2023-09-25 CVE-2023-3279 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.38 Patched in 3.39
26. Patched Medium · 6.5 NextGEN Gallery <= 3.37 - Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit ↗
    2023-09-25 CVE-2023-3155 Files or Directories Accessible to External Parties Affects <= 3.37 Patched in 3.39
27. Patched High · 7.2 WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) PHAR Deserialization ↗
    2023-09-25 CVE-2023-3154 Deserialization of Untrusted Data Affects <= 3.38 Patched in 3.39
28. Patched Medium · 4.3 NextGEN Gallery <= 3.28 - Cross-Site Request Forgery leading to Post Thumbnail Change ↗
    2023-02-14 CVE-2022-38468 Cross-Site Request Forgery Affects <= 3.28 Patched in 3.29
29. Patched High · 8.8 WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery ↗
    2020-12-17 CVE-2020-35942 Cross-Site Request Forgery Affects <= 3.4.7 Patched in 3.5.0
30. Patched High · 8.8 WordPress Gallery Plugin – NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery to Arbitrary File Upload ↗
    2020-12-17 CVE-2020-35943 Cross-Site Request Forgery Affects <= 3.4.7 Patched in 3.5.0
31. Patched Critical · 9.8 NextGEN Gallery <= 3.2.10 - SQL Injection ↗
    2019-08-27 CVE-2019-14314 Improper Neutralization of Special Elements used in an SQL Command Affects < 3.2.11 Patched in 3.2.11
32. Patched High · 8.8 Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update ↗
    2019-02-25 Missing Authorization Affects < 3.1.7 Patched in 3.1.7
33. Patched High · 8.8 NextGen Gallery <= 3.1.5 - PHP Object Injection ↗
    2019-02-04 Deserialization of Untrusted Data Affects <= 3.1.5 Patched in 3.1.6
34. Patched High · 7.5 WordPress Gallery Plugin – NextGEN Gallery <= 2.2.46 - Sensitive Information Disclosure ↗
    2018-03-02 CVE-2018-7586 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.2.46 Patched in 2.2.50
35. Patched Medium · 4.8 NextGEN Gallery <= 2.2.44 - Cross-Site Scripting via image alt and title text ↗
    2018-02-14 CVE-2018-1000172 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.44 Patched in 2.2.45
36. Patched High · 8.3 NextGen Gallery <= 2.1.77 - SQL Injection ↗
    2017-02-17 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.1.77 Patched in 2.1.79
37. Patched Critical · 9.8 NextGEN Gallery <= 2.1.56 - Authenticated Local File Inclusion & SQL injection ↗
    2016-11-15 CVE-2016-10889 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.1.56 Patched in 2.1.57
38. Patched High · 7.5 NextGen Gallery <= 2.1.56 - Remote File Inclusion ↗
    2016-11-15 CVE-2016-6565 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 2.1.56 Patched in 2.1.57
39. Patched High · 8.8 NextGen Gallery <= 2.1.10 - Unrestricted File Upload ↗
    2015-12-23 CVE-2015-9228 Unrestricted Upload of File with Dangerous Type Affects <= 2.1.10 Patched in 2.1.15
40. Patched Medium · 5.5 WordPress Gallery Plugin – NextGEN Gallery <= 2.1.15 - Authenticated (Admin+) Cross-Site Scripting ↗
    2015-09-14 CVE-2015-9229 Improper Neutralization of Input During Web Page Generation Affects <= 2.1.15 Patched in 2.1.23
41. Patched Medium · 6.4 NextGen Gallery <= 2.1.9 - Cross-Site Scripting ↗
    2015-08-31 CVE-2015-9537 Improper Neutralization of Input During Web Page Generation Affects <= 2.1.9 Patched in 2.1.10
42. Patched Medium · 6.5 NextGen Gallery <= 2.1.10 - Local File Inclusion ↗
    2015-08-28 CVE-2015-9538 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 2.1.10 Patched in 2.1.15
43. Patched Medium · 6.5 NextGen Gallery <= 2.1.7 - Path Traversal ↗
    2015-08-28 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.1.7 Patched in 2.1.9
44. Patched High · 8.8 WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Cross-Site Request Forgery ↗
    2015-03-25 CVE-2015-1784 Cross-Site Request Forgery Affects < 2.0.77.3 Patched in 2.0.77.3
45. Patched High · 8.8 WordPress Gallery Plugin – NextGEN Gallery < 2.0.77.3 - Arbitrary File Upload ↗
    2015-03-25 CVE-2015-1785 Unrestricted Upload of File with Dangerous Type Affects < 2.0.77.3 Patched in 2.0.77.3
46. Patched High · 8.8 NextGen Gallery <= 2.0.65 - Arbitrary File Upload ↗
    2014-05-20 Unrestricted Upload of File with Dangerous Type Affects <= 2.0.65 Patched in 2.0.66
47. Patched High · 7.5 NextGen Gallery <= 2.0 - Path Traversal ↗
    2014-02-18 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.0 Patched in 2.0.7
48. Patched Critical · 9.8 WordPress Gallery Plugin – NextGEN Gallery <= 1.9.12 - Arbitrary File Upload ↗
    2013-06-13 CVE-2013-3684 Unrestricted Upload of File with Dangerous Type Affects <= 1.9.12 Patched in 1.9.13
49. Patched High · 7.5 WordPress Gallery Plugin – NextGEN Gallery 1.9.10 - 1.9.11 - Full Path Disclosure ↗
    2013-02-14 CVE-2013-0291 Exposure of Sensitive Information to an Unauthorized Actor Affects 1.9.10 - 1.9.11 Patched in 2.0.0
50. Patched Medium · 6.1 SWFUpload <= 2.2.0.1 - Cross-Site Scripting ↗
    2012-11-09 CVE-2012-3414 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.6 Patched in 1.9.7
51. Patched Medium · 6.1 NextGen Gallery <= 1.9.7 - Cross-Site Scripting ↗
    2012-06-14 CVE-2012-3414 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.7 Patched in 1.9.8
52. Patched Medium · 6.1 WordPress Gallery Plugin – NextGEN Gallery <= 1.5.1 - Cross-Site Scripting ↗
    2010-04-06 CVE-2010-1186 Improper Neutralization of Input During Web Page Generation Affects < 1.5.2 Patched in 1.5.2
53. Patched Medium · 4.4 NextGEN Gallery Plugin <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2008-06-07 CVE-2008-7175 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.0 Patched in 1.9.1

Translated into 75 languages, 7 at 90% or more

Plus 51 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-07-24 400K+ → 300K+ down after 595 days in tier
2. 2024-12-06 500K+ → 400K+ down after 483 days in tier
3. 2023-08-11 600K+ → 500K+ down after 406 days in tier
4. 2022-07-01 700K+ → 600K+ down after 447 days in tier
5. 2021-04-10 800K+ → 700K+ down after 434 days in tier
6. 2020-02-01 900K+ → 800K+ down after 487 days in tier
7. 2018-10-02 1M+ → 900K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery into a readme, a review or a deck. It updates itself.

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: 300K+ active installs, 4.3★ (4,342 reviews). Plugin Pulse (WP Mayor), as of 2026-11-02. https://plugins.wpmayor.com/plugin/nextgen-gallery