Description

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-05T08:16:40.993Z",
  "pubdate": "2026-09-05T08:16:40.993Z",
  "executiveSummary": "The FooGallery plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing within the 'custom_settings' shortcode attribute. This security flaw stems from inadequate input sanitization and output escaping mechanisms, allowing malicious actors to inject arbitrary JavaScript into the application's persistent storage.\nThe vulnerability affects all versions of FooGallery up to, and including, 3.3.2. Exploitation requires the attacker to possess at least contributor-level privileges, which permits the creation or editing of posts containing the affected shortcode. Once injected, the payload is executed within the browser of any user who views the compromised page, including high-privileged administrators.\nThe impact of this vulnerability is significant, as successful exploitation enables attackers to execute scripts in the context of the victim's session. This could lead to unauthorized actions, the exfiltration of sensitive session cookies, account takeover, or redirection to malicious third-party domains. Given the nature of Stored XSS, the threat is persistent, as the script triggers automatically upon page rendering without requiring further interaction from the victim. Organizations utilizing affected versions are at high risk of site-wide compromise if administrative users are targeted, necessitating prompt updates and strict management of user permissions.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting (XSS) flaw located within the handling of the 'custom_settings' attribute for FooGallery shortcodes. The core architectural defect is the absence of rigorous input validation and the failure to perform output encoding when rendering shortcode attributes within the Document Object Model (DOM).\nIn the affected versions (up to 3.3.2), the application logic parses shortcode attributes provided by users. When a contributor-level user crafts a post or page, they can insert a malicious payload into the 'custom_settings' attribute. Because the plugin fails to sanitize this input against script tags or HTML event handlers (e.g., onerror, onload, or javascript: pseudo-protocols), the malicious script is stored directly in the WordPress database.\nThe attack flow follows a structured trajectory: First, the authenticated attacker, possessing at least contributor privileges, crafts a specially formatted shortcode containing a JavaScript payload within the 'custom_settings' parameter. Second, this shortcode is saved as part of the page content within the WordPress database. Third, when an unsuspecting user (such as an editor or administrator) views the compromised post, the FooGallery plugin processes the shortcode on the server side and renders it into the HTML document delivered to the client browser. Finally, the browser parses the malicious payload as legitimate script content, resulting in execution within the origin of the WordPress site.\nBecause the payload is stored persistently in the database, the execution is not time-bound to the initial injection. Any subsequent visit to the page triggers the script, allowing for asynchronous attacks. The payload operates within the scope of the victim's session, effectively bypassing standard CSRF protections by utilizing the victim's authenticated state to perform unauthorized API calls or exfiltrate session identifiers (such as auth cookies) to an attacker-controlled listener.\nThis vulnerability highlights a critical failure in the plugin’s data handling pipeline, specifically the disregard for the principle of 'never trust user input.' By failing to utilize standard WordPress security functions like sanitize_text_field() for input or esc_js() / esc_attr() for output, the component exposes the platform to persistent malicious code execution."
}