4.8
Medium
CVE-2024-3899 The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image…
Description
The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Gallery Plugin for WordPress 1.8 | earliest → < 1.8.15 | 1.8.15 |
| envira_gallery 1.8 | earliest → < 1.8.15 | 1.8.15 |