CVE-2026-116563

Name of the Vulnerable Software and Affected Versions NextGEN Gallery versions prior to 4.5.5

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the comment parameter, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Successful exploitation requires the site to use Shutter or Shutter Reloaded as the active lightbox, and the injected content must be approved through the standard WordPress moderation workflow.

Recommendations Update to version 4.5.5 or later.