NextGEN Gallery EUVD-2026-114573

Exploitation is not simply remote-unauthenticated despite PR:N: it requires two specific, concrete preconditions stated in the description. First, the site must have 'Shutter' or 'Shutter Reloaded' selected as the active NextGEN Gallery lightbox, since the flaw lives in that lightbox's handling of the 'comment' parameter - sites using a different lightbox are not exploitable. Second, the attacker's injected comment must be approved through WordPress's standard comment moderation workflow before the payload is ever rendered to other visitors, meaning a human moderator step gates every attack and payloads in unapproved or spam-filtered comments never fire. These two factors (non-universal lightbox configuration plus mandatory moderation approval) are the primary real-world limiters and are precisely why the CVSS attack complexity is High; the submission step itself needs no authentication.

This is a medium-severity stored DOM-based XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) whose real-world priority is moderate rather than high. The signals are internally consistent and point to a bounded threat: AV:N and PR:N mean the initial comment can be submitted remotely by an unauthenticated attacker, and S:C with C:L/I:L reflects that the payload executes in other visitors' browser context rather than on the server. However, AC:H is well justified by the description's two independent preconditions - the site must have Shutter or Shutter Reloaded selected as the active lightbox, and the malicious comment must pass WordPress's standard moderation workflow before it is ever rendered - both of which are outside the attacker's control. No EPSS score is provided in the input, there is no CISA KEV listing, and the references are plugin source-code lines and the fix changeset rather than a working exploit, so there is no evidence of active or automated exploitation. The vuln.today decision label is 'this_month', consistent with a real but non-emergency issue. Net: a genuine vulnerability worth patching in a normal cycle, not a high-CVSS-but-illusory risk, but its exploitability is materially constrained by moderation and the non-universal lightbox requirement.

On a site using Shutter or Shutter Reloaded as its active NextGEN Gallery lightbox, an unauthenticated attacker submits a gallery comment containing a crafted 'comment' value with a scripting payload. After a moderator approves the comment through WordPress's normal workflow, the payload is rendered unsanitized and executes in the browser of every subsequent visitor who opens the affected page. No public working exploit is identified in the input; the only references are the vulnerable lightbox source lines and the fix changeset.