CVE-2024-2296 is a stored cross-site scripting vulnerability in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin. It occurs due to improper neutralization of input during web page generation, specifically through SVG file uploads. Authenticated users with administrator privileges can exploit this to inject arbitrary scripts that execute in the context of users viewing the injected pages. The vulnerability affects all plugin versions up to and including 1.8.21 and is limited to multi-site WordPress installations or those with unfiltered_html disabled. No official patch or remediation details are provided in the available data.

An authenticated administrator can inject malicious scripts via SVG uploads, which execute when other users access the injected pages. This can lead to limited confidentiality and integrity impacts (e.g., session hijacking or defacement) but does not affect availability. The vulnerability is scoped to multi-site or restricted HTML capability environments, reducing its broader impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit administrator access to trusted users only and consider disabling SVG uploads or restricting file types accepted by the plugin. Monitor the vendor’s communications for updates and apply patches promptly once available.