{
 "id": "WPSEC-2026-1128",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1128/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1128/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1128/index.md",
 "title": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image IPTC Metadata",
 "description": "The NextGEN Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IPTC title and caption metadata of imported images in all versions up to, and including, 4.5.2 due to insufficient input sanitization when the metadata is written to the image's alt text and description. These values are later rendered via innerHTML in the Shutter lightbox. This makes it possible for authenticated attackers with access to upload images to galleries (author-level access and above where granted) to inject arbitrary web scripts that execute whenever a user views the affected gallery image in the lightbox.",
 "plugin": {
  "slug": "nextgen-gallery",
  "name": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery",
  "full_name": "Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery",
  "wordpress_org": "https://wordpress.org/plugins/nextgen-gallery/",
  "advisories_url": "https://wpsec.com/vuln/plugin/nextgen-gallery/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/nextgen-gallery"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.3",
 "remediation": "Update to 4.5.3 or later.",
 "fix_released": "2026-10-15T18:06:31+00:00",
 "published": "2026-10-16T18:43:17+00:00",
 "updated": "2026-10-16T09:49:46.155871+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1128/",
  "https://plugins.svn.wordpress.org/nextgen-gallery/tags/4.5.3/",
  "https://wordpress.org/plugins/nextgen-gallery/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/nextgen-gallery",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}