EUVD-2026-36645
GHSA-fq2x-2hqx-f6x7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires victim page-visit for payload execution (UI:R); contributor auth confirmed (PR:L); scope change affects victim browsers (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and including, 3.1.31 This is due to an incomplete JavaScript event handler blacklist in the foogallery_sanitize_javascript() function, which blocks only a subset of HTML event attributes (onmouseover, onmouseout, onpointerenter, onclick, onload, onchange, onerror) while permitting others such as 'onmouseenter', combined with the failure to escape the attribute key when building the gallery container HTML in foogallery_build_container_attributes_safe(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in FooGallery WordPress plugin versions through 3.1.31 allows authenticated contributors to inject persistent JavaScript via the 'custom_attribute_key' shortcode parameter, executing against any visitor who views an affected page. The flaw combines a bypass-prone event-handler blacklist in foogallery_sanitize_javascript() - which omits handlers like 'onmouseenter' - with unescaped attribute key output in foogallery_build_container_attributes_safe(), together enabling DOM-level script injection. A patched version 3.1.32 is confirmed released; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The affected product is the FooGallery (Photo Gallery by FooGallery - Responsive Image Gallery, Masonry Gallery & Carousel) WordPress plugin, per CPE cpe:2.3:a:fooplugins:photo_gallery_by_foogallery_:_responsive_image_gallery,_masonry_gallery_&_carousel:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), manifesting as a dual failure in two distinct functions. First, foogallery_sanitize_javascript() at functions.php#L480 uses a substring blocklist that covers only seven specific HTML event attributes - onmouseover, onmouseout, onpointerenter, onclick, onload, onchange, and onerror - leaving the broader HTML5 event attribute surface (e.g., onmouseenter, onfocus, onanimationend, onpointerdown) unblocked. Blocklist-based approaches for sanitizing event handlers are inherently fragile and are flagged as an anti-pattern in OWASP XSS prevention guidance precisely for this reason. Second, foogallery_build_container_attributes_safe() at functions.php#L1516 writes the caller-supplied attribute key directly into the gallery container element's HTML without HTML-encoding, so a bypassed event handler name is rendered as a live, functional DOM attribute. The advanced settings integration path at class-gallery-advanced-settings.php#L148 is also implicated in how the shortcode parameter reaches these functions.
RemediationAI
Vendor-released patch: FooGallery 3.1.32. Update via the WordPress admin dashboard under Plugins > Updates or apply changeset 3542524 directly, confirmed at https://plugins.trac.wordpress.org/changeset/3542524/foogallery/tags/3.1.32/includes/functions.php. If immediate patching is not feasible, restrict contributor-level and above WordPress role assignments to explicitly trusted users; this reduces the attacker pool but does not eliminate the vulnerability and may block legitimate editorial workflows. As an additional interim measure, a WordPress capability management plugin (e.g., Members, User Role Editor) can be used to revoke the ability for contributors to use gallery shortcodes in post content; this trade-off prevents gallery embedding for that role until the patch is applied. There is no server-side WAF rule that can reliably block this class of bypass without also blocking legitimate gallery shortcode use, given the similarity between valid and malicious attribute key values.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today