CVE-2024-4194

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jun 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-419409.1A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly validate user input to a CVE-2024-419414.3A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization che CVE-2024-419427.2JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is CVE-2024-419434.6I, Librarian is an open-source version of a PDF managing SaaS. PDF notes are displayed on the Item Summary page without any form of validati CVE-2024-419446.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route in CVE-2024-419453.1fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactio CVE-2024-419467.5REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX CVE-2024-419475.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another CVE-2024-419485.0biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party b CVE-2024-419496.4biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party b CVE-2024-41952.7Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authent CVE-2024-419507.5Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. H