CVE-2024-12403: WordPress Image Gallery XSS Vulnerability

CVE-2024-12403 Overview

CVE-2024-12403 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Image Gallery – Responsive Photo Gallery plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.5. The issue stems from insufficient input sanitization and output escaping on the awsmgallery parameter [CWE-79]. Unauthenticated attackers can inject arbitrary web scripts into pages, which execute when a victim clicks a crafted link. Successful exploitation can lead to session theft, credential harvesting, or actions performed in the context of the authenticated victim.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, potentially hijacking WordPress administrator sessions and pivoting to full site compromise.

Affected Products

WordPress plugin: Image Gallery – Responsive Photo Gallery (slug: awesome-responsive-photo-gallery)
All versions up to and including 1.0.5
Any WordPress site with the vulnerable plugin installed and activated

Discovery Timeline

2025-01-15 - CVE-2024-12403 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12403

Vulnerability Analysis

The vulnerability resides in how the plugin processes the awsmgallery request parameter. User-supplied data flows from the HTTP request into rendered page output without proper sanitization or contextual output escaping. An attacker crafts a URL that embeds JavaScript payloads in the awsmgallery parameter. When a WordPress user visits the malicious link, the injected script executes in the browser under the site's origin.

Because the attack requires no authentication and no prior privilege, any anonymous attacker can generate weaponized URLs. Reflected XSS in a WordPress admin context is particularly impactful. An attacker who lures an administrator to click the link can execute JavaScript that creates new admin users, installs malicious plugins, or exfiltrates nonces.

Root Cause

The root cause is missing input sanitization and missing output escaping in the plugin's option processing logic, referenced in inc/arpg-process-options.php. The awsmgallery parameter is reflected back to the response without functions such as esc_html(), esc_attr(), or sanitize_text_field() being applied. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation follows a standard reflected XSS pattern. The attacker crafts a URL pointing at the vulnerable WordPress site with a JavaScript payload injected into the awsmgallery query parameter. The attacker delivers the URL through phishing, forum posts, or malicious advertisements. When a victim clicks the link, the payload is reflected into the response HTML and executed by the browser. The scope change indicates the injected script can impact resources beyond the vulnerable component, such as authenticated administrative sessions. See the WordPress Plugin Code Review for the vulnerable source context.

// No verified proof-of-concept code is published for this CVE.
// The vulnerability manifests when the awsmgallery parameter
// is reflected without sanitization. See the Wordfence advisory
// for additional technical detail.

Detection Methods for CVE-2024-12403

Indicators of Compromise

HTTP requests to WordPress endpoints containing suspicious payloads in the awsmgallery parameter, such as <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E).
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting a crafted URL.
Creation of unauthorized WordPress administrator accounts or plugin installations following a suspicious admin login session.

Detection Strategies

Inspect web server access logs and WAF telemetry for requests containing the awsmgallery parameter with HTML or JavaScript metacharacters.
Monitor for anomalous WordPress admin actions such as new user creation, role changes, or plugin uploads that follow email-delivered links.
Correlate referer headers pointing to external URLs with subsequent privileged actions in WordPress audit logs.

Monitoring Recommendations

Enable WordPress activity logging plugins to capture administrative actions with user attribution and source IP.
Deploy a web application firewall with rulesets tuned for reflected XSS patterns targeting query parameters.
Alert on any HTTP 200 responses that echo unescaped <, >, or " characters from client-supplied parameters.

How to Mitigate CVE-2024-12403

Immediate Actions Required

Update the Image Gallery – Responsive Photo Gallery plugin to the latest patched version above 1.0.5 immediately.
If a patched version is not yet installed, deactivate and remove the plugin from all WordPress sites until an update is applied.
Force password resets and session invalidation for WordPress administrators who may have clicked suspicious links.

Patch Information

Refer to the WordPress Changeset Overview for the vendor's remediation. The fix introduces sanitization and output escaping for the awsmgallery parameter. Site owners should verify their installed version is above 1.0.5. Additional detail is available in the Wordfence Vulnerability Report.

Workarounds

Deploy a web application firewall rule that blocks HTTP requests containing HTML or script metacharacters in the awsmgallery parameter.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of reflected XSS payloads.
Educate administrators to avoid clicking untrusted links, especially when authenticated to WordPress admin sessions.

bash

# Example ModSecurity rule to block obvious XSS payloads in the awsmgallery parameter
SecRule ARGS:awsmgallery "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1002403,phase:2,deny,status:403,log,\
    msg:'Potential CVE-2024-12403 XSS in awsmgallery parameter'"