What is the CVSS score of CVE-2026-28141?

CVE-2026-28141 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of NextGEN Gallery are affected by CVE-2026-28141?

The NextGEN Gallery WordPress plugin (versions 4.2.3 and earlier) contains an unauthenticated cross-site scripting vulnerability that allows attackers to inject malicious scripts into pages viewed by…

Is there a public PoC exploit available for CVE-2026-28141?

Yes, a public proof-of-concept exploit is available for CVE-2026-28141. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-28141?

Within 24 hours, identify all WordPress installations using NextGEN Gallery plugin versions 4.2.3 and earlier through plugin scanning and system inventory. Within 7 days, disable the vulnerable plugin and implement compensating controls: deploy Web Application Firewall rules to block XSS patterns in plugin request paths, enable Content Security Policy headers to prevent inline script execution, restrict WordPress admin dashboard access via IP whitelist, and enable session anomaly detection. Within 30 days, monitor vendor security advisories for patch availability and develop a tested migration plan to alternative WordPress gallery plugins; once a patch is released, apply immediately after validation testing.

NextGEN Gallery CVE-2026-28141

EUVD-2026-53944 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-9v8v-v93j-cwvg

WordPress XSS Nextgen Gallery Wordpress Plugin Syed Balkhi

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network XSS with browser-scope change warrants C:L and I:L; availability impact removed as standard XSS does not disrupt service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:21 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

AnalysisAI

Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

NextGEN Gallery is a widely-used WordPress photo gallery plugin developed by Syed Balkhi (CPE: cpe:2.3:a:syed_balkhi:nextgen_gallery:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), indicating that user-controllable input is insufficiently sanitized or escaped before being reflected or stored in HTML output rendered to browsers. The scope change (S:C) in the CVSS 3.1 vector is significant: it signals that the XSS payload executes outside the security boundary of the plugin itself, meaning a script injected via NextGEN Gallery can run in the broader WordPress page context and access session cookies, localStorage, or perform privileged actions on behalf of the authenticated victim.

RemediationAI

Update NextGEN Gallery to the version released after 4.2.3; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-nextgen-gallery-plugin-4-2-3-cross-site-scripting-xss-vulnerability for the confirmed fixed release, as an exact patched version number was not independently verifiable from the available dataset - patch status is confirmed available per Patchstack advisory. As a compensating control pending upgrade, site operators can restrict public-facing gallery pages to authenticated users only, which eliminates unauthenticated exploitation but will break intended public gallery functionality. Web Application Firewall rules targeting XSS payloads in gallery-related request parameters can reduce exposure, though WAF bypass remains possible and should not substitute for patching. Deploying a restrictive Content Security Policy header with a script-src directive that blocks inline scripts can limit the blast radius of a successful XSS injection by preventing arbitrary script execution.