CVEvulnerability
CVE-2014-3123
2.1 LOW
Official page ↗
- Status
- Modified
- Published
- 2014-05-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:N/AC:H/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.
Affected configurations
• wpgetready nextcellent gallery (<= 1.9.17)
• wpgetready nextcellent gallery 1.9.14
• wpgetready nextcellent gallery 1.9.15
• wpgetready nextcellent gallery 1.9.16
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://secunia.com/advisories/58031 Vendor Advisory
- http://www.securityfocus.com/bid/67085 www.securityfocus.com
- http://www.vapid.dhs.org/advisories/wordpress/plugins/nextCellent-gallery-1.9.13 Exploit
- https://wordpress.org/plugins/nextcellent-gallery-nextgen-legacy/changelog Patch
- http://secunia.com/advisories/58031 Vendor Advisory
- http://www.securityfocus.com/bid/67085 www.securityfocus.com
- http://www.vapid.dhs.org/advisories/wordpress/plugins/nextCellent-gallery-1.9.13 Exploit
- https://wordpress.org/plugins/nextcellent-gallery-nextgen-legacy/changelog Patch