Unscored severity · published May 8, 2014
CVE-2014-3123
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NG
Nextcellent Gallery · Wpgetready
through 1.9.17; 1.9.14; 1.9.15; 1.9.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3123
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3123
Vendor Advisory
http://secunia.com/advisories/58031
www.securityfocus.com
http://www.securityfocus.com/bid/67085
Exploit
http://www.vapid.dhs.org/advisories/wordpress/plugins/nextCellent-gallery-1.9.13
Patch
https://wordpress.org/plugins/nextcellent-gallery-nextgen-legacy/changelog
More from Nextcellent Gallery
4.8
CVE-2022-1971
The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform…