Stored DOM-Based Cross-Site Scripting in NextGEN Gallery Plugin for WordPress
CVE-2026-116563

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Photo Gallery, Sliders, Proofing And Themes – Nextgen Gallery
Vendor
CVE Published:
31 October 2026

What is CVE-2026-116563?

The NextGEN Gallery plugin for WordPress is prone to a Stored DOM-Based Cross-Site Scripting vulnerability via the 'comment' parameter in all versions up to and including 4.5.4. This issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious web scripts into pages. These injected scripts will execute when any user accesses an affected page. For exploitation to occur, the site must have either the Shutter or Shutter Reloaded lightbox active, and the crafted comment needs approval through the WordPress standard moderation process before the payload can affect other site visitors.

Affected Version(s)

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery 0 <= 4.5.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/nextgen-galler...
https://plugins.trac.wordpress.org/browser/nextgen-galler...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

UKO
.