CVE-2024-4194

The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

• CWE-94

• https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album-slider.php#L207Product
• https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album.php#L185Product
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3097986%40album-and-image-gallery-plus-lightbox&new=3097986%40album-and-image-gallery-plus-lightbox&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4822f1c7-3f83-416c-8957-17e4b53d7e69?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album-slider.php#L207Product
• https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album.php#L185Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4822f1c7-3f83-416c-8957-17e4b53d7e69?source=cveThird Party Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41934Improper access control in some Intel(R) GPA software before…5.9
• CVE-2024-41935In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2024-41936A directory traversal vulnerability affecting Vonets industr…7.5
• CVE-2024-41937Apache Airflow, versions before 2.10.0, have a vulnerability…6.1
• CVE-2024-41938A vulnerability has been identified in SINEC NMS (All versio…3.8
• CVE-2024-41939A vulnerability has been identified in SINEC NMS (All versio…8.8
• CVE-2024-41940A vulnerability has been identified in SINEC NMS (All versio…9.1
• CVE-2024-41941A vulnerability has been identified in SINEC NMS (All versio…4.3
• CVE-2024-41942JupyterHub is software that allows one to create a multi-use…7.2
• CVE-2024-41943I, Librarian is an open-source version of a PDF managing Saa…4.6
• CVE-2024-41944Xibo is a content management system (CMS). An SQL injection …6.5
• CVE-2024-41945fuels-ts is a library for interacting with Fuel v2. The typ…3.1