Stored Cross-Site Scripting in FooGallery for WordPress
CVE-2026-9134
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 June 2026
What is CVE-2026-9134?
The FooGallery plugin for WordPress has a vulnerability that allows authenticated attackers with contributor-level access to exploit the 'custom_attribute_key' shortcode parameter. This results in stored cross-site scripting due to insufficient validation in the foogallery_sanitize_javascript() function. The existing blacklist only restricts certain HTML event attributes, enabling attackers to inject arbitrary scripts into web pages that execute when users access the manipulated content. This vulnerability poses a significant threat to the security of WordPress sites using the affected versions of the plugin.
Affected Version(s)
Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel 0 <= 3.1.31