CVE-2024-2744: Nextgen Gallery < 3.59.1 - Admin+ Stored XSS

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-05-17 · updated 2026-06-17
Weakness: CWE-79

Description

The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Affected products

Photo Gallery, Sliders, Proofing and Themes: before 3.59.1 — fixed in 3.59.1

How to fix

Upgrade to a fixed version: Photo Gallery, Sliders, Proofing and Themes 3.59.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/a5579c15-50ba-4618-95e4-04b2033d721f/
https://wpscan.com/vulnerability/a5579c15-50ba-4618-95e4-04b2033d721f/

Get alerted when CVE-2024-2744 or the next vulnerability affects your stack