Stored Cross-Site Scripting Vulnerability Affects ImagePress Image Gallery Plugin

CVE-2024-9776

What is CVE-2024-9776?

The ImagePress – Image Gallery plugin for WordPress has a vulnerability allowing for Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This vulnerability affects all versions of the plugin up to and including 1.2.2. Authenticated attackers with administrator-level permissions can exploit this issue to inject arbitrary web scripts into WordPress pages, executing them whenever a user accesses an affected page. Only multi-site installations and setups with unfiltered_html disabled are impacted, potentially exposing sensitive user data and undermining website integrity.

References