CVE-2024-12623: 
WordPress vulnerability analysis and mitigation

The DICOM Support plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-12623) that affects all versions up to and including 0.10.6. The vulnerability was discovered on March 24, 2025, and was patched in version 0.10.7. The plugin allows users to upload DICOM files to the WordPress media library and display them using the DICOM Web Viewer (DWV) (NVD).

The vulnerability exists in the plugin's 'dcm' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. The issue has been assigned a CVSS v3.1 Base Score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

Users should update the DICOM Support plugin to version 0.10.7 or later, which contains the security fix for this vulnerability (WordPress Changeset).