CVE-2020-35942

A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings…

published February 9, 2021

CVSS
—
EPSS
1%
Percentile
71.8
In the wild
Unconfirmed
What it is

A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01375 · 71.8th percentile
Published
2021-02-09T17:49Z
EPSS history
Timeline
  • 09 FEB 17:49Z
    A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings…
    cvelistv5