Now officially on WordPress.org

CVE Database / CVE-2026-28141

CVE · High

CVE-2026-28141 — Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] < 4.2.4

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-28141 Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery] < 4.2.4 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') High 7.1 < 4.2.4 4.2.4 2026-05-20 —

CVE-2026-28141

Versions of the NextGEN Gallery plugin prior to 4.2.3 contain a vulnerability that allows an attacker to inject malicious code into a website, potentially compromising user data and site security without requiring authentication. This flaw arises from insufficient input validation in the affected software. The issue can be exploited by unverified users, posing a risk to websites utilizing these versions of the plugin.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings