CVE-2024-11002

published 2024-11-26

CVE-2024-11002: The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all…

Priority P3 40 medium 6.3 CVSS 3.1

AV N AC L PR L UI N S U C L I L A L

The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all versions up to, and including, 2.1.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
pluginus	inpost_gallery	< 2.1.4.3	2.1.4.3
realmag777	inpost_gallery	<= 2.1.4.2	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94