# Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.5.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image IPTC Metadata

- **ID:** WPSEC-2026-1128
- **Plugin:** Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (`nextgen-gallery`), https://wordpress.org/plugins/nextgen-gallery/
- **Affected versions:** all versions before 4.5.3
- **Fixed in:** 4.5.3 (Update to 4.5.3 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/nextgen-gallery
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1128/

## Description

The NextGEN Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IPTC title and caption metadata of imported images in all versions up to, and including, 4.5.2 due to insufficient input sanitization when the metadata is written to the image's alt text and description. These values are later rendered via innerHTML in the Shutter lightbox. This makes it possible for authenticated attackers with access to upload images to galleries (author-level access and above where granted) to inject arbitrary web scripts that execute whenever a user views the affected gallery image in the lightbox.

## References

- https://wpsec.com/vuln/WPSEC-2026-1128/
- https://plugins.svn.wordpress.org/nextgen-gallery/tags/4.5.3/
- https://wordpress.org/plugins/nextgen-gallery/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1128/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.