CVE-2024-2471 is a stored cross-site scripting vulnerability in the FooGallery plugin for WordPress, affecting all versions up to and including 2.4.14. The issue arises from improper neutralization of input in image attachment fields such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type'. Authenticated attackers with author-level access or higher can inject arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4, indicating medium severity. There is no vendor advisory or patch information provided, and no known exploits have been reported.

Successful exploitation allows an authenticated user with author-level privileges or higher to inject malicious scripts into image attachment fields. These scripts execute in the browsers of users who view the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability and requires user interaction to trigger the script execution. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider removing or sanitizing image attachment field inputs manually. Monitor the FooGallery plugin's official channels for updates or patches addressing this vulnerability.