GCVE - cpe:2.3:a:fooplugins:foogallery:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:fooplugins:foogallery:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Fooplugins (`c696dc2f-d022-5073-b1dd-2fa768cce1c9`)
Product	Foogallery (`4d2e5731-1a45-5f11-8271-a394e4fd1a0a`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/crumptonr52/foogallery`	purl2cpe	2026-06-01 10:11:52.458281
`pkg:github/fooplugins/foogallery`	purl2cpe	2026-06-01 10:11:52.458283

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-2122`	vulnerable	2026-06-08 06:33:30.381420	FooGallery <= 2.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URL MEDIUM (6.4) The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom URLs in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-06-14T05:39:15.584Z Updated: 2026-04-08T17:13:33.397Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/a69e9802-9087-4cd9-86eb-b64a82bc7c0b?source=cve https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3100157%40foogallery&new=3100157%40foogallery&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-6747`	vulnerable	2026-06-08 06:21:55.627777	FooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting MEDIUM (6.4) The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contributors and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2024-01-03T08:29:48.789Z Updated: 2026-04-08T17:27:54.361Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/dce8ac32-cab8-4e05-bf6f-cc348d0c9472?source=cve https://fooplugins.com/foogallery-wordpress-gallery-plugin/pricing/ https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.9/includes/functions.php#L1609 https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.9/includes/class-gallery-advanced-settings.php?rev=3027668#L149	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-44244`	vulnerable	2026-06-08 06:12:39.667588	WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Scripting (XSS) HIGH (7.1) Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.44 versions. Published: 2023-10-02T08:58:32.940Z Updated: 2026-04-28T16:08:40.174Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/foogallery/wordpress-foogallery-plugin-2-2-44-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-44233`	vulnerable	2026-06-08 06:12:39.642783	WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Request Forgery (CSRF) MEDIUM (5.4) Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions. Published: 2023-10-06T15:04:46.655Z Updated: 2026-04-28T16:08:39.892Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/foogallery/wordpress-foogallery-plugin-2-2-44-cross-site-request-forgery-csrf-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-29439`	vulnerable	2026-06-08 06:02:40.211465	WordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS) HIGH (7.1) Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions. Published: 2023-05-16T14:11:22.935Z Updated: 2026-04-28T16:08:18.263Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/foogallery/wordpress-foogallery-plugin-2-2-35-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve https://lourcode.kr/posts/CVE-2023-29439-Analysis?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-24357`	vulnerable	2026-06-08 05:30:04.240119	FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue. Published: 2021-06-14T13:37:14.000Z Updated: 2024-08-03T19:28:23.478Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/950f46ae-4476-4969-863a-0e55752953b3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-20182`	vulnerable	2026-06-08 05:13:30.562106	Details available The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. Published: 2020-01-09T21:01:39.000Z Updated: 2024-08-05T02:39:09.106Z Open on db.gcve.eu Reference links https://medium.com/%40Pablo0xSantiago/cve-2019-20182-foogallery-image-gallery-wordpress-plugin-1-8-12-stored-cross-site-scripting-d5864f1259f	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.