EUVD-2026-71932
GHSA-hg52-mxw8-pwmh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or register contributor account
-
DeliveryInject script payload into custom_settings shortcode attribute
-
ExploitPublish post or page with malicious gallery shortcode
-
ExecutionVictim administrator visits injected page
-
PersistInjected JavaScript executes in admin browser context
-
ImpactSteal session cookies or forge privileged admin request
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to hold at minimum a WordPress contributor account on the target site - this is the binding prerequisite. The attacker must have the capability to create or edit posts or pages that include a FooGallery |
| Impact | The provided CVSS 6.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a network-accessible, low-complexity flaw requiring only contributor-level authentication. The UI:N metric warrants scrutiny: stored XSS inherently requires a victim to visit the injected page before the payload fires, which most CVSS guidance classifies as UI:R - the published score may be marginally inflated as a result, and this assessment uses UI:R in its independent vector. No EPSS score, CISA KEV listing, or public POC is present in the available intelligence, indicating no confirmed or widespread exploitation at time of analysis. Real-world priority is strongly shaped by site configuration: even a mid-sized municipal IT team in inowroclaw running a WordPress installation with open contributor registration should treat this as an urgent remediation, given that a single rogue or compromised contributor account is sufficient to plant persistent payloads targeting administrative sessions. Sites that restrict contributor access to verified, trusted individuals face substantially reduced practical risk. |
| Exploit ScenarioDerived | An attacker registers or compromises a contributor-level account on a WordPress site running FooGallery ≤3.3.2, then creates or edits a post embedding a gallery shortcode with a malicious JavaScript payload in the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 05, 2026
Stored XSS in the FooGallery WordPress plugin (all versions through 3.3.2) allows authenticated contributors to inject persistent JavaScript via the custom_settings shortcode attribute. The malicious payload executes in any visitor's browser when they access an affected page, enabling session hijacking, credential theft, or privilege escalation against higher-privileged users including site administrators. No public exploit code or CISA KEV listing has been identified, but the low privilege barrier - a contributor account - makes this realistically exploitable on sites with open or loosely managed contributor registration.
RemediationAI
Update the FooGallery plugin to the latest available version beyond 3.3.2. A fix has been committed to the WordPress plugin repository as changeset 3680965 (https://plugins.trac.wordpress.org/changeset/3680965/foogallery); the exact patched release version number is not independently confirmed from the available data, so administrators should verify the current stable release on the WordPress plugin directory before updating. As an interim workaround prior to patching, audit and restrict contributor-level accounts, removing any untrusted users who have access to post or page creation. Additionally, review existing pages for gallery shortcodes inserted by contributors and remove or quarantine any suspicious custom_settings attribute content. Restricting the use of the FooGallery shortcode via a shortcode management plugin (e.g., disabling it for contributor roles) is a viable compensating control but may disrupt legitimate content; weigh this trade-off against the site's contributor trust model.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FooGallery is a WordPress gallery plugin distributed by FooPlugins (CPE: cpe:2.3:a:fooplugins:gallery_:_foogallery). It exposes a [foogallery] shortcode that accepts a custom_settings attribute, which is passed through JavaScript rendering logic in foogallery.4cc6f51b.js and PHP processing in class-gallery-advanced-settings.php and functions.php. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: the plugin fails to sanitize shortcode attribute values before embedding them into page output, allowing attacker-controlled script content to persist in the WordPress database and execute in the victim's browser context. The CVSS scope change (S:C) accurately reflects XSS escaping the plugin's own execution context to compromise the broader browser session.
Know when Gallery gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires victim to visit the injected page (UI:R); contributor authentication is required (PR:L); payload escapes plugin context to affect victim browser session (S:C).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
XSS and SQLi in huge IT gallery v1.1.5 for Joomla. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to
lib/flowplayer.swf.php in Gallery 3 before 3.0.9 does not properly remove query fragments, which allows remote attackers
XSS in huge IT gallery v1.1.5 for Joomla. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable,
The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the resp
Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attac
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, le
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevart Responsiv
The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do not properly remove query parameters and fra
Multiple unspecified vulnerabilities in Gallery 3 before 3.0.4 allow attackers to execute arbitrary PHP code via unknown
Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsiv
Exploit-DB