What NextGEN Gallery does on your site
NextGEN Gallery is a full photo manager that runs alongside, not inside, the WordPress Media Library. You create galleries, fill them one image at a time, from a ZIP archive, from a folder on the server or from the Media Library, then group them into albums and organize them with tags. By default the files live in wp-content/gallery/ with their thumbnails, and they are described in three tables of the plugin’s own (ngg_gallery, ngg_pictures, ngg_album). Titles, captions and EXIF or IPTC metadata can be imported along with the files.
On the front end, the free version offers three gallery styles (thumbnails, slideshow, image browser) and two album styles (compact and extended), added with an editor block or the [ngg] and [imagely] shortcodes. Clicking an image opens it in the lightbox of your choice: Simplelightbox by default, Fancybox, Thickbox, Shutter or Shutter Reloaded. Text or image watermarks, drag-and-drop sorting and WP-CLI commands (wp ngg) are included. Since version 4.0 (December 2025), the admin area has been rebuilt and sits under an "Imagely" menu.
The developer, Imagely, sells paid plans (Starter, Plus, Pro, Ultra) that add layouts (mosaic, masonry, filmstrip), right-click protection, a full-screen lightbox with comments and sharing, and, from the Pro plan up, photo sales, client proofing, print lab fulfillment and Adobe Lightroom sync.
Which sites NextGEN Gallery is a good fit for
NextGEN Gallery earns its place when photos are the main content of the site:
- Photographers and portfolios: hundreds of images sorted into galleries and nested albums, with metadata import and watermarking on upload.
- Nonprofits, clubs and archives: one album per season or event, filled from a ZIP file or a folder, without cluttering the Media Library.
- Photographers who sell their work: with the Pro plan, prints, digital downloads and proofing are handled in the same interface as the galleries.
It is the wrong tool for a handful of occasional galleries: the core WordPress Gallery block is enough and keeps images in the Media Library. For a homepage carousel, a slider plugin such as MetaSlider is a better match.
NextGEN Gallery strengths and limitations
Strengths
- Built for large libraries. Nested albums, tags, ZIP and folder import and bulk sorting, all in the free version.
- Five lightboxes and watermarking for free. No second plugin needed to enlarge images or sign them.
- Assets load only where needed. Since version 4.2.3, its styles and scripts are no longer loaded on pages without a gallery.
- A path to selling. The Pro plan adds Stripe or PayPal payments, proofing, print lab fulfillment and Lightroom without switching tools.
Limitations
- Images outside the Media Library. Separate folder and tables: moving to another gallery plugin later means a real migration.
- Protection and sales cost extra. Right-click protection starts with the Plus plan, photo sales with the Pro plan.
- First-year introductory pricing. Imagely states that renewals are charged at full price, twice the advertised amount.
- An interface in transition. Since the 4.0 rebuild, several options are hidden and many screens are still untranslated in other languages.
The NextGEN Gallery settings we recommend
All of these settings exist in the current free version, under Imagely > Settings. Save each screen, then run the checks below.
| Setting | Recommended value | Why |
|---|---|---|
| Lightbox Library Imagely > Settings > Lightbox Effects | Simplelightbox (default), or None if your theme already provides a lightbox | Two lightboxes on the same image open on top of each other; keep only one. |
| Lightbox Context Same screen | Only apply to Imagely images (default) | Other images on the site stay under the control of your theme or page builder. |
| Path to galleries Imagely > Settings > Image Options | wp-content/gallery/ (default) | This path only applies to new galleries; a shared folder such as wp-content/uploads has been rejected since version 4.3.0. |
| Change options and Manage others gallery Imagely > Settings > Roles & Capabilities | Administrator (default) | These rights control the settings and other people’s galleries; a writer does not need them. |
| Add gallery / Upload images Same screen | Administrator (default), or Editor if your writers add photos | Every role allowed to upload files widens the attack surface. |
| Add MediaRSS link Imagely > Settings > Miscellaneous | Off (default) | This link in the page header only matters if a third-party service publishes your galleries from the feed. |
| Disable the /ngg_tag/ page Same screen | On if your tags are only for internal sorting | NextGEN notes that these public pages reveal your image tags; keep them if they bring you traffic. |
- Open a page with a gallery and click an image: only one lightbox should open.
- View the source of a page without a gallery: no file from the
nextgen-galleryfolder should be loaded. - In Plugins, check that NextGEN Gallery is at version 4.5.5 or later.
- Log in with an Author or Editor account and confirm it cannot reach the Imagely settings.
If other sites display your photos straight from your server, see also our page on image hotlink protection.
NextGEN Gallery security: a steady stream of fixes
A plugin that accepts uploads, reads their metadata and renders HTML captions exposes more surface than a simple gallery. The published vulnerabilities most worth knowing:
- CVE-2020-35942, fixed in 3.5.0: a cross-site request forgery (CSRF) let an attacker who tricked an administrator change settings, leading to file upload and code execution.
- CVE-2023-3155 and CVE-2023-3279, fixed in 3.39: arbitrary file read and delete, and local file inclusion, with an administrator account.
- CVE-2024-3097, versions up to 3.59: without an account, anyone could read the EXIF metadata of any image uploaded through the plugin (CVSS 5.3).
- CVE-2026-116563, fixed in 4.5.5: unauthenticated stored XSS through a link title in a comment, executed by the Shutter and Shutter Reloaded lightboxes (CVSS 5.4).
Between versions 4.5.0 and 4.5.5 (September and October 2026), the developer also shipped a long series of hardening fixes: ZIP imports, REST API routes, per-gallery permissions, lightbox captions. Turn on automatic updates for the plugin (see our guide to automatic plugin updates) and follow published advisories (monitoring your plugins for vulnerabilities). WP Masquerade Pro removes part of NextGEN’s footprint, which makes it harder for bots targeting these flaws to spot it, but it does not replace updating.
What WP Masquerade hides for NextGEN Gallery
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to NextGEN Gallery: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
- JavaScript variables
nextgen_lightbox_settings - CSS classes
ngg-*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
NextGEN Gallery FAQ
Where does NextGEN Gallery store photos?
By default in wp-content/gallery/, one folder per gallery, with separate database tables. The images do not show up in the Media Library, although the plugin can import images from it.
Where did the old Gallery menu go?
Since version 4.0, the admin area lives under the Imagely menu. The old screens can be brought back with the "Show legacy admin pages" option, found on a hidden settings tab.
Can I sell photos with the free version?
No. Payments, proofing, price lists and print lab fulfillment require the Pro plan, listed at $279 a year for five sites ($139.50 for the first year).
Does NextGEN Gallery stop people from copying my photos?
The free version can add a watermark. Blocking right-click and drag-and-drop starts with the Plus plan; it gets in the way of casual copying but cannot prevent it, since the image is still sent to the browser.