NextGEN Gallery CVE-2026-28141

The attacker requires no authentication and no account on the target WordPress site (PR:N from CVSS vector). Exploitation does require victim interaction - a user must visit or be socially engineered into loading a page or URL that triggers the XSS payload (UI:R from CVSS vector). The vulnerability is present in any WordPress deployment running NextGEN Gallery version 4.2.3 or earlier; no non-default plugin configuration is cited as a prerequisite in the available data, implying it affects standard plugin installations. Exploitation impact is bounded by the need for victim interaction, and the highest-impact scenarios - such as administrative session hijacking leading to full site takeover - depend on an administrator visiting the malicious page while actively authenticated.

The CVSS 3.1 base score of 7.1 (High) reflects a network-accessible, low-complexity attack requiring no authentication (AV:N/AC:L/PR:N) but mandating victim interaction (UI:R), which moderates realistic exploitability compared to fully automated attacks. The scope change (S:C) elevates the score above typical unauthenticated reflected XSS. No EPSS score was included in the input data, so exploitation probability cannot be quantified probabilistically. The absence of a CISA KEV listing and no identified public exploit code makes this a medium operational priority despite the High CVSS base score. For WordPress deployments where administrators or logged-in editors visit public gallery pages, the risk is materially higher due to the potential for privilege escalation via session hijacking or nonce theft. The A:L availability impact in the provided CVSS vector is atypical for XSS and may reflect page-disruption scenarios; this metric warrants verification against the full Patchstack advisory detail, as the available data does not explain it.

An unauthenticated attacker identifies a NextGEN Gallery input vector - such as a URL parameter or gallery-related field - that reflects unsanitized content into the HTML response, then crafts a malicious link embedding a JavaScript payload. When a victim, including a logged-in WordPress administrator, visits the crafted URL or page, the script executes in their browser context, potentially exfiltrating session cookies or WordPress nonces that could enable full site compromise. No public proof-of-concept code has been identified at time of analysis.