Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image IPTC Metadata
- ID
- WPSEC-2026-1128
- Plugin
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (nextgen-gallery)
- Affected
- all versions before 4.5.3
- Remediation
- Update to 4.5.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The NextGEN Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IPTC title and caption metadata of imported images in all versions up to, and including, 4.5.2 due to insufficient input sanitization when the metadata is written to the image's alt text and description. These values are later rendered via innerHTML in the Shutter lightbox. This makes it possible for authenticated attackers with access to upload images to galleries (author-level access and above where granted) to inject arbitrary web scripts that execute whenever a user views the affected gallery image in the lightbox.
References
- https://wpsec.com/vuln/WPSEC-2026-1128/
- https://plugins.svn.wordpress.org/nextgen-gallery/tags/4.5.3/
- https://wordpress.org/plugins/nextgen-gallery/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS