CVE Database /
CVE-2020-35942
CVE · High
CVE-2020-35942 — Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] < 3.5.0
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2020-35942
|
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] < 3.5.0 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
High
8.8
|
< 3.5.0
|
3.5.0 |
2020-12-17 |
—
|
CVE-2020-35942
The NextGEN Gallery plugin before version 3.5.0 contained a flaw in its authorization check that allowed attackers to bypass the "is_authorized_request" function by omitting the nonce parameter from requests. This vulnerability could be exploited to upload malicious code disguised as CSS files using double extensions like file.php.css, which could then be loaded as gallery templates to achieve remote code execution and cross-site scripting attacks when visitors viewed galleries using the compromised templates.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings