CVE-2026-28141
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) vulnerability in NextGEN Gallery versions up to 4.2.3. An attacker can inject malicious script without authentication.
Risk Assessment
Risk of session hijacking, admin account takeover, or malware distribution on the WordPress site.
Recommendation
Update the NextGEN Gallery plugin to the latest version that includes the security fix.
Other vulnerabilities in NextGEN Gallery
See all- CVE-2026-9059Critical
SQL Injection vulnerability in NextGEN Gallery prior to version 4.2.1. An authenticated attacker with 'NextGEN Gallery overview' capability can inject arbitrary SQL into the ORDER BY clause via the 'orderby' parameter in REST API endpoints. Root cause is insufficient sanitization in '_clean_column()' using a blacklist approach.
- CVE-2026-6566Medium
The NextGEN Gallery plugin for WordPress up to version 4.2.0 has an Insecure Direct Object Reference vulnerability in the image deletion REST API. Object-level authorization is missing – only 'NextGEN Manage gallery' permissions are checked, without gallery ownership verification. An authenticated attacker with Subscriber privileges and 'NextGEN Manage gallery' capability can delete other users' images and associated files from disk.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.