Plugin icon

Gallery by FooGallery

foogallery

Vulnerabilities:

21

Last Updated:

March 30, 2026

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Fixed in
Fixed in 2.4.29
CVSS
7.1 (high)
Published
2026-02-15
Title
FooGallery < 3.1.13 - Missing Authorization
Fixed in
Fixed in 3.1.13
CVSS
4.3 (medium)
Published
2026-02-15
Title
FooGallery < 3.1.13 - Authenticated (Author+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.1.13
CVSS
6.4 (medium)
Published
2026-02-10
Title
Gallery by FooGallery < 3.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure
Fixed in
Fixed in 3.1.10
CVSS
4.3 (medium)
Published
2025-07-10
Title
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel < 2.4.32 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Fixed in
Fixed in 2.4.32
CVSS
6.4 (medium)
Published
2025-03-07
Title
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel < 2.4.30 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates
Fixed in
Fixed in 2.4.30
CVSS
4.3 (medium)
Published
2025-03-07
Title
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel < 2.4.30 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size
Fixed in
Fixed in 2.4.30
CVSS
6.4 (medium)
Published
2025-02-27
Title
FooGallery < 2.4.30 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.4.30
CVSS
6.1 (medium)
Published
2024-06-13
Title
FooGallery < 2.4.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URL
Fixed in
Fixed in 2.4.16
CVSS
6.4 (medium)
Published
2024-05-23
Title
FooGallery < 2.4.15 - Author+ Stored XSS
Fixed in
Fixed in 2.4.15
CVSS
5.9 (medium)
Published
2024-04-05
Title
FooGallery < 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields
Fixed in
Fixed in 2.4.15
CVSS
6.4 (medium)
Published
2024-04-05
Title
FooGallery < 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.4.15
CVSS
6.4 (medium)
Published
2024-02-14
Title
Best WordPress Gallery Plugin – FooGallery < 2.4.9 -Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 2.4.9
CVSS
3.5 (low)
Published
2023-10-02
Title
FooGallery < 2.3.2 - Reflected XSS
Fixed in
Fixed in 2.3.2
CVSS
7.1 (high)
Published
2023-09-29
Title
FooGallery < 2.3.2 - Extensions Mgt via CSRF
Fixed in
Fixed in 2.3.2
CVSS
5.4 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.2.44
CVSS
6.1 (medium)
Published
2023-04-13
Title
FooGallery < 2.2.41 - Reflected XSS
Fixed in
Fixed in 2.2.41
CVSS
7.1 (high)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 2.1.34
CVSS
4.3 (medium)
Published
2021-05-31
Title
FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting
Fixed in
Fixed in 2.0.35
CVSS
5.5 (medium)
Published
2020-08-26
Title
FooGallery < 1.9.25 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.9.25
CVSS
4.8 (medium)
Published
2019-02-26
Title
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Fixed in
Fixed in 1.6.17
CVSS
9.9 (critical)