CVE-2024-4035 is a stored cross-site scripting vulnerability (CWE-79) in the Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery WordPress plugin. The flaw exists due to improper neutralization of input during web page generation, specifically in the handling of image alt text. Authenticated attackers with author-level access or higher can inject arbitrary web scripts that persist and execute when other users access the affected pages. This vulnerability affects all versions up to and including 2.7.7.21. The CVSS 3.1 base score is 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with author-level or higher privileges can inject malicious scripts into image alt text fields, which are then stored and executed in the context of users viewing the affected pages. This can lead to unauthorized actions or data exposure limited to the confidentiality and integrity of the affected site. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and consider removing or sanitizing image alt text inputs manually. Monitor for updates from the vendor or plugin maintainers regarding patches or official mitigations.