Skip to content
PluginCanary

Envira Gallery

Envira Gallery - Image Photo Gallery, Albums, Video Gallery, Slideshows & More
by Syed Balkhi · 100,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 23 Oct 2026, 21 releases in 24 months, no unpatched vulnerabilities.

81/ 100 Canary Score
Sub-scores for Envira Gallery
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Quick answers

Is Envira Gallery still maintained?
Yes. Last release 23 Oct 2026, 21 releases in the last 24 months. 23 Oct 2026 · wordpress.org
Who owns Envira Gallery, and has it changed hands?
Changed. New committer yagniksangani made a first commit on 1 Oct 2026. 1 Oct 2026 · SVN log
Was Envira Gallery removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Envira Gallery safe?
21 known vulnerabilities, all fixed (latest in 1.16.2). Not on the exploited list. 9 Oct 2026 · Wordfence Intelligence
Is the latest Envira Gallery update safe to install?
Caution. Ownership change before 1.16.3: new committer yagniksangani made a first commit on 1 Oct 2026. No one-star spike after it. 23 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
dimensionmedia29 Jul 2016 to 1 Jun 2022, 59 commits
chrisakelley8 Dec 2016 to 15 Feb 2024, 76 commits
poxtron2 Apr 2024 to 8 Sep 2026, 36 commits
yagniksangani1 Oct 2026 to 23 Oct 2026, 6 commits

New committer yagniksangani made a first commit on 1 Oct 2026.

Maintenance

Last release
12 days ago
Releases, 24 months
21
Tested up to
7.1 current
Requires PHP
7.0 supported 8.2+
Releases per quarter
Releases per quarter for Envira Gallery
Q1 20242
Q2 202478
Q3 20243
Q4 20242
Q1 20252
Q2 20251
Q3 20252
Q4 20254
Q1 20262
Q2 20262
Q3 20265
Q4 20263

Last release 23 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 3.7 (3 reviews). Lifetime: 4.7.

Average rating per quarter for Envira Gallery
Q2 20254.8
Q3 20254.3
Q4 20255.0
Q1 20264.0
Q2 20264.3
Q3 20262.6
Q4 20265.0

Average rating rose from 4.8 to 5.0 between Q2 2025 and Q4 2026.

Rating distribution
5 star1430
4 star52
3 star15
2 star32
1 star68
Latest low reviews

Security record

14 vulnerabilities in 24 months (21 on record), all patched (latest fixed in 1.16.2).

Show 21 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
9 Oct 2026Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.16.1 - Missing Authorization4.3<= 1.16.11.16.2Patched before disclosure
9 Oct 2026Envira Gallery <= 1.16.1 - Authenticated (Author+) Information Exposure4.3<= 1.16.11.16.2Patched before disclosure
9 Oct 2026Envira Gallery <= 1.16.1 - Authenticated (Admin+) Arbitrary Plugin Installation7.2<= 1.16.11.16.2Patched before disclosure
9 Oct 2026Envira Gallery <= 1.16.1 - Authenticated (Author+) Insecure Direct Object Reference4.3<= 1.16.11.16.2Patched before disclosure
9 Oct 2026Envira Gallery <= 1.16.1 - Missing Authorization4.3<= 1.16.11.16.2Patched before disclosure
5 Oct 2026Envira Gallery <= 1.16.0 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 1.16.01.16.1Patched before disclosure
5 Oct 2026Envira Gallery <= 1.16.0 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 1.16.01.16.1Patched before disclosure
27 Aug 2026Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description6.4<= 1.12.41.12.5Patched before disclosure
15 Jun 2026Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.12.5 - Missing Authorization5.3<= 1.12.51.12.6Patched before disclosure
13 May 2026Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter6.4<= 1.12.41.12.5Patched before disclosure
3 Mar 2026Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API6.4<= 1.12.31.12.4Patched before disclosure
12 Nov 2025Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions4.3<= 1.12.01.12.11
7 Nov 2025Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion4.3<= 1.11.01.12.0Patched before disclosure
3 Dec 2024Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library6.4<= 1.8.151.8.16Patched before disclosure
26 Aug 2024Envira Photo Gallery <= 1.8.14 - Missing Authorization4.3<= 1.8.141.8.15Patched before disclosure
20 Aug 2024Gallery Plugin for WordPress – Envira Photo Gallery <= 1.8.14 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 1.8.141.8.15Patched before disclosure
20 Jun 2024Envira Photo Gallery <= 1.8.7.3 - Cross-Site Request Forgery to Notice Dismissal4.3<= 1.8.7.31.8.8Patched before disclosure
8 Jan 2024Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images4.3<= 1.8.7.21.8.7.3Patched before disclosure
10 Oct 2022Gallery Plugin for WordPress – Envira Photo Gallery <= 1.8.4.6 - Reflected Cross-Site Scripting6.1< 1.8.4.71.8.4.7n/a
19 Dec 2020Envira Gallery Lite <= 1.8.3.2 - Cross-Site Scripting5.4< 1.8.3.31.8.3.3Patched before disclosure
25 Feb 2020Envira Photo Gallery <= 1.7.6 - Authenticated Stored Cross-Site Scripting6.4< 1.7.71.7.7n/a

Changelog mentions of security fixes: 1.16.1 (security); 1.16.2 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 2 support threads resolved in the last 2 months.

Momentum

100,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Envira Gallery
4 May 20263,299
11 May 20268,286
18 May 202641,474
25 May 202653,070
1 Jun 20269,381
8 Jun 20266,335
15 Jun 20266,914
22 Jun 20265,111
29 Jun 20264,174
6 Jul 202637,954
13 Jul 202688,075
20 Jul 20268,373
27 Jul 202653,072
3 Aug 202645,048
10 Aug 202652,208
17 Aug 202689,925
24 Aug 20269,047
31 Aug 20267,298
7 Sep 202652,409
14 Sep 202633,135
21 Sep 202617,544
28 Sep 202649,783
5 Oct 202692,819
12 Oct 202610,642
19 Oct 202651,990
26 Oct 202647,312
2 Nov 20261,122

Weekly downloads over the last 4 weeks are 15% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

MetaSlider GalleryScore 92 · 10,000+Gallery Custom LinksScore 91 · 30,000+Catch GalleryScore 91 · 10,000+Simple LightboxScore 90 · 100,000+Lightbox with PhotoSwipeScore 90 · 20,000+

Facts

Version1.16.3
AuthorSyed Balkhi
Added27 Jan 2014
Last updated23 Oct 2026
Active installs100,000+
Requires WordPress6.3
Tested up to7.1.4
Requires PHP7.0
CategoryE-commerce & Shopping
Tagsalbums, gallery, lightbox, image gallery, photo gallery

Other plugins by this author: WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More, WP Mail SMTP by WPForms - SMTP for Reliable Email Delivery with Gmail, Outlook, Amazon SES, Brevo, Other SMTP & More, WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager, All in One SEO - AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights), Smash Balloon Social Photo Feed - Easy Social Feeds Plugin, Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More, One Click Demo Import, Popup Builder & Popup Maker for WordPress - OptinMonster Email Marketing and Lead Generation, Easy WP SMTP - WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more, Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery, WP Mail Logging, WP Crontrol

Questions

Is Envira Gallery still maintained?

Yes. Last release 23 Oct 2026, 21 releases in the last 24 months.

Who owns Envira Gallery, and has it changed hands?

Changed. New committer yagniksangani made a first commit on 1 Oct 2026.

Was Envira Gallery removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Envira Gallery safe?

21 known vulnerabilities, all fixed (latest in 1.16.2). Not on the exploited list.

Is the latest Envira Gallery update safe to install?

Caution. Ownership change before 1.16.3: new committer yagniksangani made a first commit on 1 Oct 2026. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue