{ "title": "NextGEN Gallery", "seo_title": "NextGEN Gallery: review, recommended settings and limits", "h1": "NextGEN Gallery", "description": "NextGEN Gallery free or paid: strengths, limitations, Imagely plan pricing, lightbox and role settings, patched vulnerabilities, to help you decide.", "lead": "NextGEN Gallery organizes your photos into galleries, albums and tags, outside the WordPress Media Library. Our take on the free version and Imagely’s paid plans, the lightbox and role settings to check, and the patched vulnerabilities worth knowing.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/nextgen-gallery/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/nextgen-gallery/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/nextgen-gallery/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/nextgen-gallery/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:17:45+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "NextGEN Gallery", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/nextgen-gallery/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/nextgen-gallery/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/nextgen-gallery/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "NextGEN Gallery", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/nextgen-gallery/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/nextgen-gallery/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/nextgen-gallery/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "NextGEN Gallery", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/nextgen-gallery/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/nextgen-gallery/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/nextgen-gallery/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "NextGEN Gallery", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/nextgen-gallery/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/nextgen-gallery/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/nextgen-gallery/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "NextGEN Gallery", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/nextgen-gallery/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/nextgen-gallery/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/nextgen-gallery/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "NextGEN Gallery", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/nextgen-gallery/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/nextgen-gallery/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/nextgen-gallery/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "NextGEN Gallery", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/nextgen-gallery/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/nextgen-gallery/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/nextgen-gallery/index.json" } ], "headings": [ { "level": 1, "text": "NextGEN Gallery" }, { "level": 2, "text": "What NextGEN Gallery does on your site" }, { "level": 2, "text": "Which sites NextGEN Gallery is a good fit for" }, { "level": 2, "text": "NextGEN Gallery strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The NextGEN Gallery settings we recommend" }, { "level": 2, "text": "NextGEN Gallery security: a steady stream of fixes" }, { "level": 2, "text": "NextGEN Gallery FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for photographers and sites that sort hundreds of images into galleries and albums.\n- Main caveat: images live outside the Media Library, and protection or photo sales need a paid plan.\n- Free; plans start at $139 per year on one site ($69.50 for the first year).\n\n## What NextGEN Gallery does on your site\n\nNextGEN Gallery is a full photo manager that runs alongside, not inside, the WordPress Media Library. You create galleries, fill them one image at a time, from a ZIP archive, from a folder on the server or from the Media Library, then group them into albums and organize them with tags. By default the files live in `wp-content/gallery/` with their thumbnails, and they are described in three tables of the plugin’s own (`ngg_gallery`, `ngg_pictures`, `ngg_album`). Titles, captions and EXIF or IPTC metadata can be imported along with the files.\n\nOn the front end, the free version offers three gallery styles (thumbnails, slideshow, image browser) and two album styles (compact and extended), added with an editor block or the `[ngg]` and `[imagely]` shortcodes. Clicking an image opens it in the lightbox of your choice: Simplelightbox by default, Fancybox, Thickbox, Shutter or Shutter Reloaded. Text or image watermarks, drag-and-drop sorting and WP-CLI commands (`wp ngg`) are included. Since version 4.0 (December 2025), the admin area has been rebuilt and sits under an \"Imagely\" menu.\n\nThe developer, Imagely, sells paid plans (Starter, Plus, Pro, Ultra) that add layouts (mosaic, masonry, filmstrip), right-click protection, a full-screen lightbox with comments and sharing, and, from the Pro plan up, photo sales, client proofing, print lab fulfillment and Adobe Lightroom sync.\n\n![Diagram: NextGEN Gallery works on visitors and bots, database and files, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); generated-file folders (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/nextgen/diagram-en.svg?v=661cae57)\n\n## Which sites NextGEN Gallery is a good fit for\n\nNextGEN Gallery earns its place when photos are the main content of the site:\n\n- **Photographers and portfolios**: hundreds of images sorted into galleries and nested albums, with metadata import and watermarking on upload.\n- **Nonprofits, clubs and archives**: one album per season or event, filled from a ZIP file or a folder, without cluttering the Media Library.\n- **Photographers who sell their work**: with the Pro plan, prints, digital downloads and proofing are handled in the same interface as the galleries.\n\nIt is the wrong tool for a handful of occasional galleries: the core WordPress Gallery block is enough and keeps images in the Media Library. For a homepage carousel, a slider plugin such as [MetaSlider](https://www.wp-masquerade.com/features/camouflaged-plugins/metaslider/) is a better match.\n\n## NextGEN Gallery strengths and limitations\n\n### Strengths\n\n- **Built for large libraries.** Nested albums, tags, ZIP and folder import and bulk sorting, all in the free version.\n- **Five lightboxes and watermarking for free.** No second plugin needed to enlarge images or sign them.\n- **Assets load only where needed.** Since version 4.2.3, its styles and scripts are no longer loaded on pages without a gallery.\n- **A path to selling.** The Pro plan adds Stripe or PayPal payments, proofing, print lab fulfillment and Lightroom without switching tools.\n\n### Limitations\n\n- **Images outside the Media Library.** Separate folder and tables: moving to another gallery plugin later means a real migration.\n- **Protection and sales cost extra.** Right-click protection starts with the Plus plan, photo sales with the Pro plan.\n- **First-year introductory pricing.** Imagely states that renewals are charged at full price, twice the advertised amount.\n- **An interface in transition.** Since the 4.0 rebuild, several options are hidden and many screens are still untranslated in other languages.\n\n## The NextGEN Gallery settings we recommend\n\nAll of these settings exist in the current free version, under Imagely > Settings. Save each screen, then run the checks below.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Lightbox Library** Imagely > Settings > Lightbox Effects | Simplelightbox (default), or None if your theme already provides a lightbox | Two lightboxes on the same image open on top of each other; keep only one. |\n| **Lightbox Context** Same screen | Only apply to Imagely images (default) | Other images on the site stay under the control of your theme or page builder. |\n| **Path to galleries** Imagely > Settings > Image Options | `wp-content/gallery/` (default) | This path only applies to new galleries; a shared folder such as `wp-content/uploads` has been rejected since version 4.3.0. |\n| **Change options** and **Manage others gallery** Imagely > Settings > Roles & Capabilities | Administrator (default) | These rights control the settings and other people’s galleries; a writer does not need them. |\n| **Add gallery / Upload images** Same screen | Administrator (default), or Editor if your writers add photos | Every role allowed to upload files widens the attack surface. |\n| **Add MediaRSS link** Imagely > Settings > Miscellaneous | Off (default) | This link in the page header only matters if a third-party service publishes your galleries from the feed. |\n| **Disable the /ngg_tag/ page** Same screen | On if your tags are only for internal sorting | NextGEN notes that these public pages reveal your image tags; keep them if they bring you traffic. |\n\n- Open a page with a gallery and click an image: only one lightbox should open.\n- View the source of a page without a gallery: no file from the `nextgen-gallery` folder should be loaded.\n- In Plugins, check that NextGEN Gallery is at version 4.5.5 or later.\n- Log in with an Author or Editor account and confirm it cannot reach the Imagely settings.\n\nIf other sites display your photos straight from your server, see also our page on [image hotlink protection](https://www.wp-masquerade.com/features/image-hotlink-protection/).\n\n## NextGEN Gallery security: a steady stream of fixes\n\nA plugin that accepts uploads, reads their metadata and renders HTML captions exposes more surface than a simple gallery. The published vulnerabilities most worth knowing:\n\n- **CVE-2020-35942, fixed in 3.5.0**: a cross-site request forgery (CSRF) let an attacker who tricked an administrator change settings, leading to file upload and code execution.\n- **CVE-2023-3155 and CVE-2023-3279, fixed in 3.39**: arbitrary file read and delete, and local file inclusion, with an administrator account.\n- **CVE-2024-3097, versions up to 3.59**: without an account, anyone could read the EXIF metadata of any image uploaded through the plugin (CVSS 5.3).\n- **CVE-2026-116563, fixed in 4.5.5**: unauthenticated [stored XSS](https://www.wp-masquerade.com/glossary/xss/) through a link title in a comment, executed by the Shutter and Shutter Reloaded lightboxes (CVSS 5.4).\n\nBetween versions 4.5.0 and 4.5.5 (September and October 2026), the developer also shipped a long series of hardening fixes: ZIP imports, REST API routes, per-gallery permissions, lightbox captions. Turn on automatic updates for the plugin (see our guide to automatic plugin updates) and follow published advisories (monitoring your plugins for vulnerabilities). WP Masquerade Pro removes part of NextGEN’s footprint, which makes it harder for bots targeting these flaws to spot it, but it does not replace updating.\n\n## NextGEN Gallery FAQ\n\n**Where does NextGEN Gallery store photos?**\n\nBy default in `wp-content/gallery/`, one folder per gallery, with separate database tables. The images do not show up in the Media Library, although the plugin can import images from it.\n\n**Where did the old Gallery menu go?**\n\nSince version 4.0, the admin area lives under the Imagely menu. The old screens can be brought back with the \"Show legacy admin pages\" option, found on a hidden settings tab.\n\n**Can I sell photos with the free version?**\n\nNo. Payments, proofing, price lists and print lab fulfillment require the Pro plan, listed at $279 a year for five sites ($139.50 for the first year).\n\n**Does NextGEN Gallery stop people from copying my photos?**\n\nThe free version can add a watermark. Blocking right-click and drag-and-drop starts with the Plus plan; it gets in the way of casual copying but cannot prevent it, since the image is still sent to the browser.\n\n## Key facts\n\n- Category: Images and sliders\n- Vendor: Imagely\n- Price: Free; paid plans from $139 per year for one site ($69.50 for the first year)\n- Active installations (wordpress.org): 300 000+\n- Version: 4.5.5\n- Official page: https://wordpress.org/plugins/nextgen-gallery/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs, generated-file folders\n- Still visible: JavaScript variables, CSS classes", "catalog": "nextgen", "essentials": [ "Best for photographers and sites that sort hundreds of images into galleries and albums.", "Main caveat: images live outside the Media Library, and protection or photo sales need a paid plan.", "Free; plans start at $139 per year on one site ($69.50 for the first year)." ], "format": "application/json" }