CVE-2026-85414 in FooGallery Plugin
Summary
by MITRE • 09/05/2026
The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The FooGallery plugin for WordPress contains a critical security vulnerability identified as Stored Cross-Site Scripting within the custom_settings shortcode attribute across all versions up to 3.3.2. This flaw stems from insufficient input sanitization and output escaping mechanisms when processing user-supplied data associated with gallery configurations. The vulnerability allows authenticated attackers who possess contributor-level access or higher privileges to inject arbitrary web scripts into pages that are subsequently rendered for other users. Unlike reflected XSS where the payload is delivered via a link, this stored variant persists within the application's database, ensuring that every time an affected page is loaded by any user, the malicious script executes in their browser context without requiring further interaction from the attacker to trigger it.
From a technical perspective, the root cause lies in the plugin's failure to properly validate and escape data retrieved from the custom_settings attribute before rendering it within HTML content. When an authenticated user with sufficient privileges creates or modifies a gallery using this shortcode, they can embed JavaScript code directly into the configuration parameters. Because WordPress typically relies on plugins to handle specific output escaping for dynamic attributes, the lack of robust sanitization routines means that these scripts are not neutralized during the rendering process. Consequently, the browser interprets and executes the injected code as part of the page's legitimate content, granting the attacker a persistent execution environment within the victim's session context.
The operational impact of this vulnerability is significant due to its stored nature and relatively low privilege requirement for exploitation. Contributor-level access in WordPress allows users to manage media files and create posts or pages containing shortcodes, which are common tasks for many legitimate site members rather than just administrators. This lowers the barrier for entry significantly compared to vulnerabilities requiring admin-only privileges. Once exploited, an attacker can perform a wide range of malicious activities including session hijacking by stealing authentication cookies, defacing website content, redirecting users to phishing sites designed to steal credentials or distribute malware, and conducting keylogging attacks within the context of the vulnerable site. The persistence of the payload means that even if the initial attack vector is discovered and patched for new inputs, existing compromised galleries will continue to serve malicious scripts until they are manually corrected in the database.
This vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting within the Common Weakness Enumeration taxonomy. Specifically it represents a stored variant where user input is saved and later displayed without adequate sanitization. In terms of attack tactics this behavior corresponds to MITRE ATT&CK technique T1059 Command and Control Execution particularly through browser-based scripting which allows attackers to maintain persistence and execute commands within the victim's environment using native web technologies rather than external binaries or scripts hosted on remote servers outside the application boundary.
Mitigation strategies should focus primarily on immediate patching of the FooGallery plugin to version 3.3.3 or later where these input validation issues have been addressed by the developers. Administrators must ensure that all instances of WordPress plugins are kept up-to-date with security patches released by their respective maintainers as a standard operational procedure. For environments running vulnerable versions before an update can be applied, it is advisable to restrict contributor-level and higher privileges to trusted individuals only while monitoring for unusual activity in gallery settings or post content. Additionally implementing Content Security Policy headers can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts are allowed to execute thereby preventing many common exploitation techniques even if input validation fails completely. Regular security audits focusing on shortcodes and dynamic attribute handling within WordPress plugins are also recommended to identify similar weaknesses in other components that may share this architectural pattern.