Executive brief
FooGallery is a popular WordPress plugin for creating and managing image galleries. The plugin fails to properly validate user input in shortcode attributes, allowing authenticated contributors and administrators to inject malicious scripts that execute for all website visitors viewing affected pages. This could lead to data theft, account hijacking, or malware distribution.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the 'custom_settings' shortcode attribute caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript code via shortcode attributes, which persists in the database and executes in the browsers of any user visiting the affected page. The vulnerability affects all versions up to and including 3.3.2. No patch information is currently available from the advisory.
Affected products
- FooPlugins FooGallery up to and including 3.3.2
Timeline
- 2026-09-05: disclosed