NextCellent Gallery <= 1.19.17 is vulnerable to XSS

Published
2014-04-28

Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.

CVE

https://www.cve.org/CVERecord?id=CVE-2014-3123

CVSS

Score:5.5

Severity:Medium

Version: 1.19.17

There is a patch available in v1.19.18 and we strongly recommend you update to this version as soon as possible.