NextGEN Gallery Vulnerability – Authenticated Stored Cross-Site Scripting – CVE-2024-2744 | WordPress Plugin Vulnerability Report 

Plugin Name: NextGEN Gallery – Create an Amazing Photo Gallery in Seconds

Key Information:

  • Software Type: Plugin
  • Software Slug: nextgen-gallery
  • Software Status: Active
  • Software Author: smub
  • Software Downloads: 40,372,789
  • Active Installs: 500,000
  • Last Updated: May 12, 2024
  • Patched Versions: 3.59.1
  • Affected Versions: <= 3.59

Vulnerability Details:

  • Name: NextGEN Gallery <= 3.59
  • Title: Authenticated (Administrator+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2744
  • CVSS Score: 4.4
  • Publicly Published: April 26, 2024
  • Researcher: Dmitrii Ignatyev - CleanTalk Inc
  • Description: The NextGEN Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) through the admin settings in all versions up to, and including, 3.59. Insufficient input sanitization and output escaping allow authenticated attackers, with administrator-level permissions, to inject arbitrary web scripts that execute on user access. This vulnerability primarily affects multi-site installations or those where unfiltered_html is disabled.


The NextGEN Gallery plugin for WordPress has a vulnerability in versions up to and including 3.59 that allows authenticated administrators to perform stored XSS attacks via admin settings. This security issue has been resolved in the recently released version 3.59.1.

Detailed Overview:

Stored XSS vulnerabilities like the one found in the NextGEN Gallery plugin pose a significant risk, especially in environments with multiple users having admin access. This specific flaw could enable attackers to embed malicious scripts into the admin settings that are executed when other users access the compromised settings page. The risk involves unauthorized code execution that can alter the behavior of the site, potentially leading to data leaks or manipulation.

Advice for Users:

  • Immediate Action: Update to version 3.59.1 immediately to address this vulnerability.
  • Check for Signs of Vulnerability: Admins should review their site's settings and admin pages for unexpected scripts or behavior, which might suggest that the vulnerability has been exploited.
  • Alternate Plugins: While the patched version is secure, users concerned about ongoing security might consider exploring other well-maintained gallery plugins as alternatives.
  • Stay Updated: Always ensure that your plugins are updated to the latest versions to prevent vulnerabilities.


The swift update by the developers of NextGEN Gallery to patch this vulnerability demonstrates the ongoing need for vigilance and prompt action in software maintenance. Users, particularly those managing WordPress sites with multiple administrators, are urged to update to version 3.59.1 or later to secure their installations against this type of vulnerability. Maintaining up-to-date software is essential for protecting against potential security threats and ensuring the integrity of your digital content.


Detailed Report: 

Navigating the Security Landscape: The Imperative of Regular Updates in WordPress Plugins

In the dynamic world of website management, security is a paramount concern. The recent discovery of a significant vulnerability in the "NextGEN Gallery" plugin, popular among WordPress users for adding sophisticated photo gallery functionalities, underscores the ongoing risks associated with digital platforms. Known as CVE-2024-2744, this vulnerability highlights the necessity of vigilance and timely updates to safeguard online assets.

Impact and Risks

Stored XSS vulnerabilities like CVE-2024-2744 pose significant risks, particularly in environments with multiple administrators. Attackers could embed malicious scripts into the admin settings that execute when other administrators access the compromised settings page. These scripts could lead to data manipulation or theft, unauthorized changes to the site’s content, and other malicious activities, undermining the site's integrity and security.

Overview of Previous Vulnerabilities

NextGEN Gallery has faced 30 vulnerabilities since its inception, with each instance serving as a learning opportunity for enhancing security measures. These previous instances reinforce the need for constant monitoring and proactive updating as critical components of effective cybersecurity practices.


The prompt update provided by the developers of NextGEN Gallery to address CVE-2024-2744 exemplifies the ongoing challenges and the crucial importance of timely software updates in maintaining robust security defenses. For small business owners, especially those with limited time to oversee website operations, understanding the importance of these updates and implementing automated systems for regular maintenance can be a game-changer. Maintaining up-to-date software is essential, not only for protecting against potential security threats but also for ensuring the integrity and reliability of your digital presence.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

NextGEN Gallery Vulnerability – Authenticated Stored Cross-Site Scripting – CVE-2024-2744 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment