Description
Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
Affected products
- alex_rabe / nextgen_gallery0.95 – 0.95
- alex_rabe / nextgen_gallery1.5.1
- alex_rabe / nextgen_gallery0.33 – 0.33
- alex_rabe / nextgen_gallery0.34 – 0.34
- alex_rabe / nextgen_gallery0.35 – 0.35
- alex_rabe / nextgen_gallery0.36 – 0.36
- alex_rabe / nextgen_gallery0.37 – 0.37
- alex_rabe / nextgen_gallery0.39 – 0.39
- alex_rabe / nextgen_gallery0.40 – 0.40
- alex_rabe / nextgen_gallery0.41 – 0.41
- alex_rabe / nextgen_gallery0.42 – 0.42
- alex_rabe / nextgen_gallery0.43 – 0.43
- alex_rabe / nextgen_gallery0.50 – 0.50
- alex_rabe / nextgen_gallery0.51 – 0.51
- alex_rabe / nextgen_gallery0.52 – 0.52
- alex_rabe / nextgen_gallery0.60 – 0.60
- alex_rabe / nextgen_gallery0.61 – 0.61
- alex_rabe / nextgen_gallery0.62 – 0.62
- alex_rabe / nextgen_gallery0.63 – 0.63
- alex_rabe / nextgen_gallery0.64 – 0.64
- alex_rabe / nextgen_gallery0.70 – 0.70
- alex_rabe / nextgen_gallery0.71 – 0.71
- alex_rabe / nextgen_gallery0.72 – 0.72
- alex_rabe / nextgen_gallery0.73 – 0.73
- alex_rabe / nextgen_gallery0.74 – 0.74
- alex_rabe / nextgen_gallery0.80 – 0.80
- alex_rabe / nextgen_gallery0.81 – 0.81
- alex_rabe / nextgen_gallery0.82 – 0.82
- alex_rabe / nextgen_gallery0.83 – 0.83
- alex_rabe / nextgen_gallery0.90 – 0.90
- alex_rabe / nextgen_gallery0.91 – 0.91
- alex_rabe / nextgen_gallery0.92 – 0.92
- alex_rabe / nextgen_gallery0.93 – 0.93
- alex_rabe / nextgen_gallery0.94 – 0.94
- alex_rabe / nextgen_gallery0.96 – 0.96
- alex_rabe / nextgen_gallery0.97 – 0.97
- alex_rabe / nextgen_gallery0.98 – 0.98
- alex_rabe / nextgen_gallery0.99 – 0.99
- alex_rabe / nextgen_gallery1.0.0 – 1.0.0
- alex_rabe / nextgen_gallery1.0.1 – 1.0.1
- alex_rabe / nextgen_gallery1.0.2 – 1.0.2
- alex_rabe / nextgen_gallery1.1.0 – 1.1.0
- alex_rabe / nextgen_gallery1.2.0 – 1.2.0
- alex_rabe / nextgen_gallery1.2.1 – 1.2.1
- alex_rabe / nextgen_gallery1.3.0 – 1.3.0
- alex_rabe / nextgen_gallery1.3.1 – 1.3.1
- alex_rabe / nextgen_gallery1.3.2 – 1.3.2
- alex_rabe / nextgen_gallery1.3.3 – 1.3.3
- alex_rabe / nextgen_gallery1.3.4 – 1.3.4
- alex_rabe / nextgen_gallery1.3.5 – 1.3.5
- alex_rabe / nextgen_gallery1.3.6 – 1.3.6
- alex_rabe / nextgen_gallery1.4.0 – 1.4.0
- alex_rabe / nextgen_gallery1.4.1 – 1.4.1
- alex_rabe / nextgen_gallery1.4.2 – 1.4.2
- alex_rabe / nextgen_gallery1.4.3 – 1.4.3
- alex_rabe / nextgen_gallery1.5.0 – 1.5.0
References
- EXPLOIThttp://www.exploit-db.com/exploits/12098
- VENDOR_ADVISORYhttp://secunia.com/advisories/39341
- MISChttp://www.securityfocus.com/bid/39250
- MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/57562
- MISChttp://wordpress.org/extend/plugins/nextgen-gallery/changelog/
- MISChttp://www.coresecurity.com/content/nextgen-gallery-xss-vulnerability
- VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2010/0821