So, this “advisory” is basically telling us that a blog owner can introduce any HTML, including scripts, into his/her own blog? OMG! BBQ! WTF?

Cheers for the heads up. Have removed said plugin as a result. Hope they have a fix soon as I was enjoying playing with this.

[...] that I could use easily within wordpress is a great help. I just found out that there is an XSS flaw in the Next Gen Gallery script. Does anyone know how to fix this so I can get it back up and [...]

[...] en: Blogsecurity.net Etiquetas: actualización, seguridad, vulnerabilidad, [...]

As it’s possible to edit Galleries, although with quite lower User Roles than the Administrator one, depending on the Settings, it’s quite some risk. For sure it’s not too high, as everyone should be encourage to give Permissions to trusted Users only, but it’s anyway possible through blindfold grants, that bad guys can gain Administrator rights with it.
Anyway we should mostly change the advisory a bit, mostly to a recommendation only