CVE-2025-6068 in FooGallery Plugin
Summary
by MITRE • 07/11/2025
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/17/2025
The FooGallery plugin for WordPress represents a widely used tool for creating responsive photo galleries across millions of websites, making it a prime target for attackers seeking persistent access vectors. This vulnerability resides within the plugin's handling of HTML attributes, specifically the `data-caption-title` and `data-caption-description` parameters that are used to store gallery item metadata. The flaw exists in all versions up to and including 2.4.31, indicating a long-standing issue that has remained unaddressed in the codebase. The vulnerability stems from inadequate sanitization of user inputs and insufficient escaping of output data, creating a classic stored cross-site scripting scenario where malicious code can persist in the database and execute whenever affected pages are rendered.
The technical exploitation of this vulnerability requires an authenticated attacker with Contributor-level permissions or higher, which represents a significant concern as many WordPress sites have contributors with elevated privileges. Attackers can inject malicious JavaScript code into the caption title and description fields, which then gets stored in the WordPress database and executed in the context of any user who views the affected gallery page. This stored nature of the vulnerability means that the malicious code persists even after the initial injection, making it particularly dangerous for sites with multiple contributors or where administrators may not regularly audit all content. The vulnerability operates through the standard XSS attack vector where HTML attributes are not properly sanitized before being rendered back to users, allowing script execution in the victim's browser context.
The operational impact of this vulnerability extends beyond simple script execution, as it can be leveraged for cookie theft, session hijacking, and redirection to malicious sites. Attackers can craft payloads that steal user session cookies, potentially gaining access to administrator accounts or other elevated privileges. The vulnerability affects any gallery page that displays captions, making it particularly dangerous in environments where galleries are frequently updated or where contributors regularly add content. From an attacker's perspective, this represents a low-effort, high-impact vector that can be exploited to compromise entire WordPress installations, especially when combined with other vulnerabilities or social engineering techniques. The vulnerability's presence in the plugin's core functionality means that any site using this gallery feature is at risk, regardless of other security measures in place.
Mitigation strategies should focus on immediate plugin updates to versions that address the sanitization issues, though administrators should also implement additional security measures such as restricting contributor capabilities, implementing content security policies, and conducting regular security audits. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and maps to ATT&CK technique T1548.001 for privilege escalation through compromised user accounts. Organizations should also consider implementing web application firewalls to detect and block malicious payloads, as well as monitoring for unauthorized content modifications in gallery-related areas. Regular security assessments and user access reviews are essential to prevent unauthorized contributors from exploiting this vulnerability, while also ensuring that all users with Contributor-level access or higher are properly vetted and trained on security best practices.