CVE-2024-4194 is a medium severity (CVSS 6.5) code injection flaw in the Album and Image Gallery plus Lightbox plugin for WordPress. Versions up to and including 2.0 let unauthenticated visitors run arbitrary shortcodes. Update to a release newer than 2.0 or remove the plugin, and check what other plugins register shortcodes.
What's affected
The NVD record says all versions up to and including 2.0 are affected. The package is the free edition of the plugin, published under the essentialplugin vendor name in the CPE data.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. No login and no user interaction are needed, with low confidentiality and integrity impact and none on availability. That is why it is medium and not high. The record is not flagged as exploited in the wild.
The references include two source lines in the plugin's trac browser and a changeset, which points to a code fix in the plugin repository. The record does not state the first fixed version number, so read the plugin's changelog or the Wordfence entry to confirm it.
How to check if you're exposed
In the WordPress dashboard, open Plugins and look for Album and Image Gallery plus Lightbox. Read the version next to it. Version 2.0 or lower is affected.
From a shell on the server, you can list plugins and versions with WP-CLI, which is a standard administration tool: run wp plugin list from the site directory and look for the plugin slug. Fleet owners can run the same command across sites.
Also check for inactive copies. A deactivated plugin still sits on disk and its files may still be reachable by URL on some setups, so delete plugins you do not use. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related entries.
What to do now
- List the plugin and its version on every WordPress site you run.
- Update to the latest release from the WordPress plugin directory, and confirm it is newer than 2.0.
- If no fixed release exists for your setup, deactivate and delete the plugin and replace the gallery.
- Audit other plugins that expose shortcodes to anonymous visitors.
- Turn on automatic updates for plugins that are low risk to auto-update.
Why it matters
The weakness is CWE-94, improper control of generation of code. The record says the plugin ran do_shortcode on a value it did not validate. Shortcodes are WordPress's way of letting content call into plugin code, so letting a visitor choose which shortcode runs means the visitor chooses which plugin function executes.
The damage depends entirely on what shortcodes the site has installed. On a small blog it might be little. On a site with membership, form or e-commerce plugins, an attacker gets a menu of actions. That is why a medium score still deserves a patch, and why the clean fix is to validate input against a fixed list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is it safe to keep the plugin if I patch?
Once you are on a fixed version, yes in terms of this CVE. Still ask whether you need the plugin at all, since each plugin adds attack surface.
Sources
- Plugin source, aigpl-gallery-album-slider.php, listed in the NVD record but not retrievable in this review.
- Wordfence vulnerability entry, listed in the record, returned no content when fetched.
- Safeguard Gold entry for CVE-2024-4194
Last reviewed: 19 October 2026.
