Stored Cross-Site Scripting in Picture Gallery Plugin for WordPress

CVE-2024-12696

What is CVE-2024-12696?

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress presents a vulnerability that allows authenticated attackers with contributor-level access or higher to exploit the videowhisper_picture_upload_guest shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes, leading to stored Cross-Site Scripting. When a user accesses a compromised page, arbitrary web scripts can execute, posing a significant risk to site security and user safety.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References