CVE-2020-35942: imagely nextgen_gallery Cross-site Scripting
Vulnerability summary
CVE-2020-35942 is a high (CVSS 8.8) Cross-site Scripting vulnerability in imagely nextgen_gallery. EPSS estimates a 1.38% chance of exploitation in the next 30 days, higher than 71.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 09-02-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.38%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.38% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Affected systems
Imagely1 product
- nextgen_gallery< 3.5.0
Wordpress1 product
- nextgen-gallery≤ 3.4.7 (fixed in 3.5.0)
2 vendors · 2 products