Stored Cross-Site Scripting in Rbs Image Gallery WordPress Plugin
CVE-2024-10144
What is CVE-2024-10144?
The Rbs Image Gallery WordPress plugin prior to version 3.2.22 has a security flaw that fails to properly sanitize and escape certain settings. This vulnerability allows users with high privileges, such as contributors, to execute Stored Cross-Site Scripting (XSS) attacks, even when the unfiltered_html capability is disabled. This poses a significant risk, particularly in multisite installations, where it can impact the security of multiple sites.
Affected Version(s)
Photo Gallery, Images, Slider in Rbs Image Gallery 0 < 3.2.22
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved