Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More Security & Risk Analysis

The plugin "envira-gallery-lite" v1.12.4 exhibits a mixed security posture. While it demonstrates several good security practices, such as using prepared statements for all SQL queries and a high percentage of properly escaped output, there are significant areas of concern. The presence of one AJAX handler without authentication checks is a critical vulnerability that could allow unauthorized actions. Furthermore, the taint analysis revealed four flows with unsanitized paths, indicating potential for various injection vulnerabilities, although these are not classified as critical or high severity in this analysis. The plugin's vulnerability history is a major red flag, with a total of 10 known medium severity CVEs, including past instances of CSRF, Missing Authorization, and Cross-site Scripting. The fact that these are currently unpatched, despite the last vulnerability being reported in 2026, suggests a lack of timely security patching and a history of introducing exploitable flaws.

In conclusion, while the static code analysis highlights some positive security implementations, the combination of an unprotected entry point, unsanitized paths in taint flows, and a substantial history of medium-severity vulnerabilities, especially those related to authorization and input sanitization, presents a notable risk. The absence of currently unpatched critical or high vulnerabilities is a slight positive, but the recurring nature of medium vulnerabilities and the identified unprotected AJAX handler warrant careful consideration and immediate attention. The plugin's strengths lie in its SQL handling and output escaping, but its weaknesses in authorization and input validation, as evidenced by both static analysis and historical data, outweigh these benefits in the current assessment.