What is CVE-2014-3123?

CVE-2014-3123 is a vulnerability in Wpgetready Nextcellent Gallery, classified under Cross-site Scripting. Published 2014-05-08.

Is CVE-2014-3123 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Wpgetready Nextcellent Gallery

CVE-2014-3123

Cross-site scripting (XSS) vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or HTML via the "Alt & Title Text" field.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.016 (73.1th percentile) — read the EPSS interpretation.

Affected products

Wpgetready Nextcellent_gallery — versions 1.9.14, 1.9.15, 1.9.16
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

20142995/nuclei-templates

References

cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
cve@mitre.org (x_refsource_CONFIRM, Patch)
cve@mitre.org (vdb-entry, x_refsource_BID)
cve@mitre.org (Exploit, x_refsource_MISC)

Frequently asked questions

What is CVE-2014-3123?: CVE-2014-3123 is a vulnerability in Wpgetready Nextcellent Gallery, classified under Cross-site Scripting. Published 2014-05-08.
Is CVE-2014-3123 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.