CVE-2024-9776 is a stored cross-site scripting vulnerability (CWE-79) in the ImagePress – Image Gallery plugin for WordPress, present in all versions up to 1.2.2. It allows authenticated administrators on multi-site or restricted unfiltered_html installations to inject arbitrary web scripts through admin settings. These scripts execute in the context of users visiting the injected pages due to improper input neutralization during web page generation. The vulnerability requires high privileges and has a medium CVSS score of 4.4, with network attack vector and no user interaction required.

Successful exploitation allows an attacker with administrator privileges to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts within the affected WordPress environment. The vulnerability does not affect availability and requires high privileges, limiting its scope. It only affects multi-site installations or those with unfiltered_html disabled.

No official patch or fix is currently available for this vulnerability. Administrators should monitor the vendor's advisory for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or limiting the use of the ImagePress – Image Gallery plugin in multi-site or unfiltered_html-disabled environments. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.