Description
WordPress Plugin NextGEN Gallery-WordPress Gallery is prone to multiple HTML injection vulnerabilities because it fails to properly sanitize user-supplied input. Attacker supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks may also be possible. WordPress Plugin NextGEN Gallery-WordPress Gallery version 1.9.0 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.9.1 or latest
References
Related Vulnerabilities
WebLogic CVE-2019-2658 Vulnerability (CVE-2019-2658)
WordPress Plugin WP Statistics Cross-Site Scripting (9.1.2)
Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4431)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-3180)
Ampache Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2024-51485)