CVE-2026-28141

HIGH

CVE: CVE-2026-28141 - Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4Sign in to save

CVSS

7.1

CVSS v3.1

EPSS

0.2%

Exploit Prediction Score

Published

August 6, 2026

Exploitability

EPSS probability 0.2%

Description

Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

CWE-79

No package data available.

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-nextgen-gallery-plugin-4-2-3-cr…