CVE-2024-3899

CVE-2024-3899 affects the Gallery Plugin for WordPress (Envira Gallery) prior to 1.8.15. The issue is a stored cross-site scripting (XSS) vulnerability due to insufficient sanitization/escaping of image settings, exploitable by users with post-writing privileges (e.g., Authors). Red Hat and CVE d...

CVE-2024-3899: Improper Neutralization of Input During Web Page Generation

The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks...