HomeWordPress vulnerabilitiesFooGallery Photo Gallery
FooGallery Photo Gallery vulnerabilities
FooGallery Photo Gallery has 16 known vulnerabilities in this database. The most recent published record is dated 5 Sep 2026.
- Known vulnerabilities
- 16
- Active installs
- 100,000+
- Latest version
- 3.3.7
- Last updated
- 24 Sep 2026
- Most recent
- 5 Sep 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Cross-site scripting (XSS) CVE-2026-85414 | Medium 6.4 | Up to 3.3.2 | Fixed in a later version (latest 3.3.7) | 5 Sep 2026 |
| Cross-site scripting (XSS) CVE-2026-9134 | Medium 6.4 | Up to 3.1.31 | Fixed in a later version (latest 3.3.7) | 13 Jun 2026 |
| Broken access control CVE-2025-15524 | Medium 4.3 | Up to 3.1.9 | Fixed in a later version (latest 3.3.7) | 11 Feb 2026 |
| Cross-site scripting (XSS) CVE-2025-6068 | Medium 6.4 | Before 2.4.32 | Fixed in 2.4.32 | 11 Jul 2025 |
| Cross-site scripting (XSS) CVE-2024-12119 | Medium 6.4 | Before 2.4.30 | Fixed in 2.4.30 | 8 Mar 2025 |
| Broken access control CVE-2024-12114 | Medium 4.3 | Before 2.4.30 | Fixed in 2.4.30 | 8 Mar 2025 |
| Path traversal CVE-2023-6947 | High 7.7 | Before 2.4.27 | Fixed in 2.4.27 | 10 Dec 2024 |
| Cross-site scripting (XSS) CVE-2024-2122 | Medium 6.4 | Before 2.4.16 | Fixed in 2.4.16 | 14 Jun 2024 |
| Cross-site scripting (XSS) CVE-2024-2762 | Medium 5.4 | Before 2.4.15 | Fixed in 2.4.15 | 13 Jun 2024 |
| Cross-site scripting (XSS) CVE-2024-2081 | Medium 6.4 | Before 2.4.15 | Fixed in 2.4.15 | 9 Apr 2024 |
| Cross-site scripting (XSS) CVE-2024-2471 | Medium 6.4 | Before 2.4.15 | Fixed in 2.4.15 | 6 Apr 2024 |
| Cross-site scripting (XSS) CVE-2024-0604 | Medium 4.4 | Up to 2.4.7 | Fixed in a later version (latest 3.3.7) | 29 Feb 2024 |
| Cross-site scripting (XSS) CVE-2023-6747 | Medium 6.4 | Before 2.4.6 | Fixed in 2.4.6 | 3 Jan 2024 |
| Cross-site request forgery (CSRF) CVE-2023-44233 | Medium 5.4 | Up to 2.2.44 | Fixed in a later version (latest 3.3.7) | 6 Oct 2023 |
| Cross-site scripting (XSS) CVE-2021-24357 | Medium 5.4 | Before 2.0.35 | Fixed in 2.0.35 | 14 Jun 2021 |
| Cross-site scripting (XSS) CVE-2019-20182 | Medium 4.8 | Up to 1.8.12 | Fixed in a later version (latest 3.3.7) | 9 Jan 2020 |
Read the published descriptions
- CVE-2026-85414, 5 Sep 2026
- The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2026-9134, 13 Jun 2026
- The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and including, 3.1.31 This is due to an incomplete JavaScript event handler blacklist in the foogallery_sanitize_javascript() function, which blocks only a subset of HTML event attributes (onmouseover, onmouseout, onpointerenter, onclick, onload, onchange, onerror) while permitting others such as 'onmouseenter', combined with the failure to escape the attribute key when building the gallery container HTML in foogallery_build_container_attributes_safe(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2025-15524, 11 Feb 2026
- The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax_get_gallery_info() function in all versions up to, and including, 3.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve metadata (name, image count, thumbnail URL) of private, draft, and password-protected galleries by enumerating gallery IDs. CVE record
- CVE-2025-6068, 11 Jul 2025
- The FooGallery - Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-12119, 8 Mar 2025
- The FooGallery - Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the default_gallery_title_size parameter in all versions up to, and including, 2.4.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with granted gallery and album creator roles, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-12114, 8 Mar 2025
- The FooGallery - Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogallery_attachment_modal_save AJAX action due to missing validation on a user controlled key (img_id). This makes it possible for authenticated attackers, with granted access and above, to update arbitrary post and page content. This requires the Gallery Creator Role setting to be a value lower than 'Editor' for there to be any real impact. CVE record
- CVE-2023-6947, 10 Dec 2024
- The Best WordPress Gallery Plugin - FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive information such as folder structure. CVE record
- CVE-2024-2122, 14 Jun 2024
- The Best WordPress Gallery Plugin - FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom URLs in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-2762, 13 Jun 2024
- The FooGallery WordPress plugin before 2.4.15, foogallery-premium WordPress plugin before 2.4.15 does not validate and escape some of its Gallery settings before outputting them back in the page, which could allow users with a role as low as Author to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin CVE record
- CVE-2024-2081, 9 Apr 2024
- The Best WordPress Gallery Plugin - FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the foogallery_attachment_modal_save action in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-2471, 6 Apr 2024
- The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type') in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-0604, 29 Feb 2024
- The Best WordPress Gallery Plugin - FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE record
- CVE-2023-6747, 3 Jan 2024
- The Best WordPress Gallery Plugin - FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contributors and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2023-44233, 6 Oct 2023
- Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin - FooGallery plugin <= 2.2.44 versions. CVE record
- CVE-2021-24357, 14 Jun 2021
- In the Best Image Gallery & Responsive Photo Gallery - FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue. CVE record
- CVE-2019-20182, 9 Jan 2020
- The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. CVE record
What to do if you run FooGallery Photo Gallery
If you run FooGallery Photo Gallery , open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new FooGallery Photo Gallery vulnerabilities
Free. We email you when a new vulnerability is published for FooGallery Photo Gallery , usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.