/Vulnerability Library

NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting

CVE-2026-28141
Verified

Description

NextGEN Gallery through 4.2.3 reflects a URL-decoded `ngg_tag` route value into the generated tag page without the context-specific escaping added in 4.2.4. An unauthenticated attacker can break out of the tag context and inject an auto-executing script. This template injects an `svg onload` payload carrying a random nonce and matches its unencoded reflection; slash and backtick syntax keep the request off common WAF signatures.

Severity

High

CVSS Score

7.1

Exploit Probability

0%

Affected Product

nextgen-gallery

Published Date

September 11, 2026

Template Author

str4k3r

CVE-2026-28141.yaml
7.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVE ID:
cve-2026-28141
CWE ID:
cwe-79

References

https://nvd.nist.gov/vuln/detail/CVE-2026-28141https://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-nextgen-gallery-plugin-4-2-3-cross-site-scripting-xss-vulnerability?_s_id=cvehttps://wordpress.org/plugins/nextgen-gallery/

Remediation Steps

Update NextGEN Gallery to version 4.2.4 or later.