CVE-2024-10144
📋 TL;DR
This vulnerability in the Rbs Image Gallery WordPress plugin allows high-privilege users (like contributors) to inject malicious scripts into plugin settings, which then execute when other users view affected pages. It affects WordPress sites using vulnerable plugin versions, particularly in multisite configurations where unfiltered_html is restricted.
💻 Affected Systems
- Rbs Image Gallery WordPress Plugin
📦 What is this software?
Robo Gallery by Robosoft
⚠️ Risk & Real-World Impact
Worst Case
Malicious contributor could inject persistent XSS payloads that steal admin credentials, redirect users to malicious sites, or perform actions as authenticated users across the entire WordPress site.
Likely Case
Contributor-level user injects malicious scripts that affect visitors or other users viewing gallery pages, potentially stealing session cookies or performing limited malicious actions.
If Mitigated
With proper user role management and content filtering, impact is limited to low-privilege script injection affecting only specific gallery pages.
🎯 Exploit Status
Exploitation requires contributor-level access or higher. Attack vector is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.22
Vendor Advisory: https://wpscan.com/vulnerability/a83521d3-0aba-493d-8dec-e764277e69b8/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Rbs Image Gallery' plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 3.2.22+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Restrict Contributor Access
allTemporarily remove contributor role access or limit contributor accounts until patch is applied.
Disable Plugin
linuxDeactivate Rbs Image Gallery plugin if not essential for site functionality.
wp plugin deactivate rbs-image-gallery
🧯 If You Can't Patch
- Implement strict user role management and audit contributor-level accounts
- Add web application firewall rules to block XSS payloads in plugin parameter inputs
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Rbs Image Gallery version. If version is below 3.2.22, site is vulnerable.Check Version:
wp plugin list --name='rbs-image-gallery' --field=versionVerify Fix Applied:
Confirm plugin version is 3.2.22 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to gallery settings endpoints
- Multiple failed XSS attempts in plugin-related logs
Network Indicators:
- Script tags in gallery parameter requests
- Unusual outbound connections from gallery pages
SIEM Query:
source="wordpress.log" AND "rbs-image-gallery" AND ("POST" OR "update") AND ("script" OR "onerror" OR "javascript:")