WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
foogallery
Published
2024-02-14
Title
Best WordPress Gallery Plugin – FooGallery < 2.4.9 -Admin+ Stored Cross-Site Scripting
Slug
foogallery
Published
2024-04-05
Title
FooGallery < 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields
Slug
foogallery
Published
2024-04-05
Title
FooGallery < 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
foogallery
Published
2024-05-23
Title
FooGallery < 2.4.15 - Author+ Stored XSS
Slug
foogallery
Published
2024-06-13
Title
FooGallery < 2.4.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URL
Slug
foogallery
Published
2025-02-27
Title
FooGallery < 2.4.30 - Reflected Cross-Site Scripting
Slug
foogallery
Published
2025-03-07
Title
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel < 2.4.30 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size
Slug
foogallery
Published
2025-03-07
Title
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel < 2.4.30 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates
Slug
foogallery
Published
2025-07-10
Title
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel < 2.4.32 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Slug
foogallery
Published
2026-02-10
Title
Gallery by FooGallery < 3.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure
Slug
foogallery
Published
2026-02-15
Title
FooGallery < 3.1.13 - Missing Authorization
Slug
foogallery
Published
2026-02-15
Title
FooGallery < 3.1.13 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
foogallery
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
foogallery
Published
2026-06-12
Title
Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel < 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter
Slug
foogallery
Published
2026-09-04
Title
Gallery : FooGallery < 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute
Slug
foogallery-captions
Published
2025-01-16
Title
FooGallery Captions <= 1.0.2 - Reflected Cross-Site Scripting
Slug
foogallery-premium
Published
2024-01-02
Title
FooGallery Premium < 2.4.6 - Contributor+ Stored XSS
Slug
foogallery-premium
Published
2024-05-23
Title
FooGallery < 2.4.15 - Author+ Stored XSS
Slug
foogallery-premium
Published
2024-12-09
Title
Best WordPress Gallery Plugin – FooGallery < 2.4.27 - Authenticated (Contributor+) Directory Traversal
Slug
foopeople
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
foopeople
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
foosales
Published
2026-10-07
Title
FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation
Slug
foosales
Published
2026-10-09
Title
FooSales < 1.43.1 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
Slug
football-leagues-by-anwppro
Published
2024-09-23
Title
AnWP Football Leagues < 0.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Slug
football-leagues-by-anwppro
Published
2025-08-11
Title
AnWP Football Leagues < 0.16.18 - Authenticated (Administrator+) CSV Injection