Stored Cross-Site Scripting in Picture Gallery Plugin for WordPress
CVE-2024-12696
6.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 18 January 2025
What is CVE-2024-12696?
The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress presents a vulnerability that allows authenticated attackers with contributor-level access or higher to exploit the videowhisper_picture_upload_guest shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes, leading to stored Cross-Site Scripting. When a user accesses a compromised page, arbitrary web scripts can execute, posing a significant risk to site security and user safety.
Affected Version(s)
Picture Gallery – Frontend Image Uploads, AJAX Photo List * <= 1.5.22