The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
References
Configurations
Configuration 1 (hide)
|
History
09 Oct 2024, 15:36
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:essentialplugin:album_and_image_gallery_plus_lightbox:*:*:*:*:free:wordpress:*:* | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/4822f1c7-3f83-416c-8957-17e4b53d7e69?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album.php#L185 - Product | |
| References | () https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album-slider.php#L207 - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.3 |
| First Time |
Essentialplugin album And Image Gallery Plus Lightbox
Essentialplugin |
|
| CWE | NVD-CWE-noinfo |
06 Jun 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-06 02:15
Updated : 2024-10-09 15:36
NVD link : CVE-2024-4194
Mitre link : CVE-2024-4194
JSON object : View
Products Affected
essentialplugin
- album_and_image_gallery_plus_lightbox
CWE