Threats tagged 'ghsa-mmc9-9v24-7pg8'

The NextGEN Gallery WordPress plugin (versions up to and including 4.5.4) contains a stored DOM-based cross-site scripting (XSS) vulnerability via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use the Shutter or Shutter Reloaded lightbox and for the injected comment to be approved through WordPress's moderation system before the payload executes for other users.