CVE-2024-10034

The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery link text parameter in all versions up to, and including, 3.2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3192798%40simply-gallery-block%2Ftrunk&old=3176753%40simply-gallery-block%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/89bd70b2-0b5f-4edb-890b-d291bdb8a851?source=cve

Published

Nov 22, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10028The Everest Backup – WordPress Cloud Backup, Migration, Rest…7.5
• CVE-2024-10029In Eclipse GlassFish version 7.0.15 is possible to perform R…6.1
• CVE-2024-1003A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-10031In Eclipse GlassFish version 7.0.15 is possible to perform S…5.4
• CVE-2024-10032In Eclipse GlassFish version 7.0.15 is possible to perform S…5.4
• CVE-2024-10033A vulnerability was found in aap-gateway. A Cross-site Scrip…6.1
• CVE-2024-10035Improper Control of Generation of Code ('Code Injection'), I…9.8
• CVE-2024-10037A vulnerability exists in the RTU500 web server component th…5.9
• CVE-2024-10038The WP-Strava plugin for WordPress is vulnerable to Stored C…6.1
• CVE-2024-1004A vulnerability, which was classified as critical, was found…7.2
• CVE-2024-10040The Infinite-Scroll plugin for WordPress is vulnerable to Cr…4.3
• CVE-2024-10041A vulnerability was found in PAM. The secret information is …4.7