CVE-2021-24293: Imagely NextGen Gallery

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.

Affected products

• Imagely NextGen Gallery: before 3.1.11 (fixed in 3.1.11)

Published 2021-05-05. Last modified 2026-06-17.