Foogallery
Approved changes feed: RSS · Atom
cpe:2.3:a:fooplugins:foogallery:*:*:*:*:-:wordpress:*:*
part: a version: * update: *
| Vendor | Fooplugins (c696dc2f-d022-5073-b1dd-2fa768cce1c9) |
|---|---|
| Product | Foogallery (4d2e5731-1a45-5f11-8271-a394e4fd1a0a) |
| Edition | * |
| Language | * |
| Software edition | - |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/crumptonr52/foogallery |
purl2cpe | 2026-06-01 10:11:52.459757 |
pkg:github/fooplugins/foogallery |
purl2cpe | 2026-06-01 10:11:52.459759 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-6068 |
vulnerable | 2026-06-08 07:43:14.210114 |
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
MEDIUM (6.4)
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-07-11T07:23:00.715Z
Updated: 2026-04-08T17:13:33.722Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2762 |
vulnerable | 2026-06-08 06:35:27.292971 |
FooGallery < 2.4.15 - Author+ Stored XSS
The FooGallery WordPress plugin before 2.4.15, foogallery-premium WordPress plugin before 2.4.15 does not validate and escape some of its Gallery settings before outputting them back in the page, which could allow users with a role as low as Author to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
Published: 2024-06-13T06:00:02.252Z
Updated: 2024-10-30T18:53:38.973Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2471 |
vulnerable | 2026-06-08 06:33:31.186084 |
FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields
MEDIUM (6.4)
The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type') in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2024-04-06T05:37:15.277Z
Updated: 2026-04-08T17:26:13.102Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2081 |
vulnerable | 2026-06-08 06:33:30.308672 |
FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting
MEDIUM (6.4)
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the foogallery_attachment_modal_save action in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2024-04-09T18:59:29.076Z
Updated: 2026-04-08T17:29:19.089Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12119 |
vulnerable | 2026-06-08 06:23:51.297776 |
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size
MEDIUM (6.4)
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the default_gallery_title_size parameter in all versions up to, and including, 2.4.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with granted gallery and album creator roles, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-03-08T05:30:08.997Z
Updated: 2026-04-08T16:41:14.872Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-12114 |
vulnerable | 2026-06-08 06:23:51.288126 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0604 |
vulnerable | 2026-06-08 06:22:01.467142 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.