Skip to content
Sign in
5.5 Medium

CVE-2024-10034 The Gallery Blocks with Lightbox

Description

The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery link text parameter in all versions up to, and including, 3.2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product Affected versions Fixed in
Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery 3.2 earliest → 3.2.4.2 No fix stated
Mixed Media Gallery Blocks 3.2 earliest → 3.2.4.2 No fix stated

Other CVEs of Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery

The 4 CVEs of Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery →
CVE-2025-14288 The Gallery Blocks with Lightbox 4.3 Medium CVE-2022-4974 The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request… 6.3 Medium CVE-2024-5424 The Gallery Blocks with Lightbox 6.4 Medium
Track this CVE