CVE-2024-9878

Summary

CVE-2024-9878 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Photo Gallery by 10Web plugin for WordPress. This issue, present in versions up to and including 1.8.30, allows authenticated attackers with administrator-level permissions to inject malicious scripts into admin settings. The consequence is the execution of these scripts whenever a user accesses an injected page. This vulnerability poses a significant risk in multi-site installations and setups where unfiltered_html has been disabled.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.