Executive brief
FooGallery, a popular WordPress plugin used for creating image galleries, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into website pages. These scripts execute automatically when other visitors view the affected gallery, potentially leading to unauthorized actions or data theft. This issue stems from an incomplete security filter that fails to block certain types of web commands within gallery settings.
Technical details
The FooGallery plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to an incomplete JavaScript event handler blacklist in the foogallery_sanitize_javascript() function. While the function blocks common event attributes like 'onclick' and 'onload', it permits others such as 'onmouseenter'. Furthermore, the foogallery_build_container_attributes_safe() function fails to properly escape the attribute key when generating the gallery container HTML. Authenticated attackers with contributor-level permissions can exploit this by providing a malicious 'custom_attribute_key' via a shortcode. A patch is available in version 3.1.32.
Affected products
- FooPlugins FooGallery up to, and including, 3.1.31
Timeline
- 2026-06-13: advisory: Initial disclosure by Wordfence and NVD publication.
- 2026-06-13: patched: Fixed in version 3.1.32.
References
- https://plugins.trac.wordpress.org/browser/foogallery/trunk/includes/class-gallery-advanced-settings.php
- https://plugins.trac.wordpress.org/browser/foogallery/trunk/includes/functions.php
- https://plugins.trac.wordpress.org/browser/foogallery/trunk/includes/functions.php
- https://plugins.trac.wordpress.org/changeset/3542524/foogallery/tags/3.1.32/includes/functions.php?old=3535930&old_path=foogallery%2Ftags%2F3.1.31%2Fincludes%2Ffunctions.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9650e6-7c3c-4510-9749-a3503924855f?source=cve