sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total22
Critical0
High3
Medium19
Reset
Showing 1-20 of 22 records
Threat Entry Updated 2026-09-08

Foogallery - Cross-Site Scripting (XSS) (CVE-2026-85414)

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Foogallery

CVE-2026-85414

MEDIUM CVSS 6.4 2026-09-05
Open Full Technical Breakdown
Threat Entry Updated 2026-07-23

Foogallery - Cross-Site Scripting (XSS) (CVE-2026-9134)

The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and including, 3.1.31 This is due to an incomplete JavaScript event handler blacklist in the foogallery_sanitize_javascript() function, which blocks only a subset of HTML event attributes (onmouseover, onmouseout, onpointerenter, onclick, onload, onchange, onerror) while permitting others such as 'onmouseenter', combined with the failure to escape the attribute key when building the gallery container HTML in foogallery_build_container_attributes_safe(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject…

PLUGIN Foogallery

CVE-2026-9134

MEDIUM CVSS 6.4 2026-06-13
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Cross-Site Scripting (XSS) (CVE-2024-13362)

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Foogallery

CVE-2024-13362

MEDIUM CVSS 6.1 2026-05-01
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Broken Access Control (CVE-2025-15524)

The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax_get_gallery_info() function in all versions up to, and including, 3.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve metadata (name, image count, thumbnail URL) of private, draft, and password-protected galleries by enumerating gallery IDs.

PLUGIN Foogallery

CVE-2025-15524

MEDIUM CVSS 4.3 2026-02-11
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Cross-Site Scripting (XSS) (CVE-2025-6068)

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Foogallery

CVE-2025-6068

MEDIUM CVSS 6.4 2025-07-11
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Cross-Site Scripting (XSS) (CVE-2024-12119)

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the default_gallery_title_size parameter in all versions up to, and including, 2.4.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with granted gallery and album creator roles, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Foogallery

CVE-2024-12119

MEDIUM CVSS 6.4 2025-03-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Security Vulnerability (CVE-2024-12114)

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogallery_attachment_modal_save AJAX action due to missing validation on a user controlled key (img_id). This makes it possible for authenticated attackers, with granted access and above, to update arbitrary post and page content. This requires the Gallery Creator Role setting to be a value lower than 'Editor' for there to be any real impact.

PLUGIN Foogallery

CVE-2024-12114

MEDIUM CVSS 4.3 2025-03-08
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Security Vulnerability (CVE-2025-22624)

FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 was found to be vulnerable. The web application dynamically generates web content without validating the source of the potentially untrusted data in myapp/extensions/albums/admin/class-meta boxes.php.

PLUGIN Foogallery

CVE-2025-22624

MEDIUM CVSS 5.1 2025-02-27
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Path Traversal (CVE-2023-6947)

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive information such as folder structure.

PLUGIN Foogallery

CVE-2023-6947

HIGH CVSS 7.7 2024-12-10
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Cross-Site Scripting (XSS) (CVE-2024-2122)

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom URLs in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Foogallery

CVE-2024-2122

MEDIUM CVSS 6.4 2024-06-14
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Cross-Site Scripting (XSS) (CVE-2024-2762)

The FooGallery WordPress plugin before 2.4.15, foogallery-premium WordPress plugin before 2.4.15 does not validate and escape some of its Gallery settings before outputting them back in the page, which could allow users with a role as low as Author to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin

PLUGIN Foogallery

CVE-2024-2762

MEDIUM CVSS 5.4 2024-06-13
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Cross-Site Scripting (XSS) (CVE-2024-2081)

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the foogallery_attachment_modal_save action in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Foogallery

CVE-2024-2081

MEDIUM CVSS 6.4 2024-04-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Cross-Site Scripting (XSS) (CVE-2024-2471)

The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type') in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Foogallery

CVE-2024-2471

MEDIUM CVSS 6.4 2024-04-06
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Cross-Site Scripting (XSS) (CVE-2024-0604)

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

PLUGIN Foogallery

CVE-2024-0604

MEDIUM CVSS 4.4 2024-02-29
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Foogallery - Cross-Site Scripting (XSS) (CVE-2023-6747)

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contributors and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Foogallery

CVE-2023-6747

MEDIUM CVSS 6.4 2024-01-03
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.