CVE-2010-1186

Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2010-04-07

Last modified

2024-08-07

Weaknesses

CWE-79

Affected products

• Nextgen Gallery (Alex Rabe)

References

• http://secunia.com/advisories/39341
• http://wordpress.org/extend/plugins/nextgen-gallery/changelog/
• http://www.coresecurity.com/content/nextgen-gallery-xss-vulnerability
• http://www.exploit-db.com/exploits/12098
• http://www.securityfocus.com/bid/39250
• http://www.vupen.com/english/advisories/2010/0821
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57562