First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-3899

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Unknown	Gallery Plugin for WordPress	< 1.8.15
enviragallery	envira_gallery	< 1.8.15

References

https://wpscan.com/vulnerability/e3afadda-4d9a-4a51-b744-10de7d8d8578/Exploit, Third Party Advisory

Timeline

Published: Sep 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-389906.3Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to CVE-2024-389918.8akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to ex CVE-2024-389928.8airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attacker CVE-2024-389939.8rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to CVE-2024-389947.3amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to e CVE-2024-389969.8ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This CVE-2024-389976.5adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows a CVE-2024-3899910.0jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows CVE-2024-39005.5Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by long Unicode sequence in ActualText.CVE-2024-390006.5adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers CVE-2024-390016.3ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability al CVE-2024-390026.3rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerability allows attacker

CVE-2024-3899: Medium severity, CVSS 4.8 | Vulnix