Multiple cross-site scripting (XSS) vulnerabilities in Gallery 1.3.4-pl1 allow remote attackers to inject arbitrary web script or HTML via (1) the index field in add_comment.php (2) set_albumName (3) slide_index (4) slide_full (5) slide_loop (6) slide_pause (7) slide_dir fields in slideshow_low.php or (8) username field in search.php.