Comments on: Nextgen gallery – XSS flaw

By: digitalpbk

digitalpbk — Fri, 17 Jul 2009 16:07:46 +0000

There is even more flaw in this plugin check out xss on wordpress nextgen library

By: Philipp

Philipp — Sun, 22 Jun 2008 15:59:01 +0000

As it’s possible to edit Galleries, although with quite lower User Roles than the Administrator one, depending on the Settings, it’s quite some risk. For sure it’s not too high, as everyone should be encourage to give Permissions to trusted Users only, but it’s anyway possible through blindfold grants, that bad guys can gain Administrator rights with it.
Anyway we should mostly change the advisory a bit, mostly to a recommendation only

By: Vulnerabilidad XSS en Nextgen Gallery en Agamum.net

Vulnerabilidad XSS en Nextgen Gallery en Agamum.net — Wed, 18 Jun 2008 14:13:41 +0000

[...] en: Blogsecurity.net Etiquetas: actualización, seguridad, vulnerabilidad, [...]

By: Next Gen Galley XSS Security Flaw » Mercury Thread Internet Marketing Blog

Next Gen Galley XSS Security Flaw » Mercury Thread Internet Marketing Blog — Wed, 18 Jun 2008 10:59:18 +0000

[...] that I could use easily within wordpress is a great help. I just found out that there is an XSS flaw in the Next Gen Gallery script. Does anyone know how to fix this so I can get it back up and [...]

By: Michael

Michael — Wed, 18 Jun 2008 10:52:32 +0000

Cheers for the heads up. Have removed said plugin as a result. Hope they have a fix soon as I was enjoying playing with this.

By: Robert

Robert — Wed, 18 Jun 2008 10:37:31 +0000

So, this “advisory” is basically telling us that a blog owner can introduce any HTML, including scripts, into his/her own blog? OMG! BBQ! WTF?