WordPress Plugin Vulnerabilities

FooGallery < 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting

Description

The Best WordPress Gallery Plugin – FooGallery plugin is vulnerable to Stored Cross-Site Scripting via the foogallery_attachment_modal_save action.

Affects Plugins

Plugin icon
foogallery
Fixed in 2.4.15

References

CVE
CVE-2024-2081
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e2edeb63-56ad-45e7-9e85-cdf0a8ef41e7

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Robert Kruczek (ProXy)
Verified
No
WPVDB ID
d11daa01-4bd3-410c-be63-9ad18052bab0

Timeline

Publicly Published
2024-04-05 (about 2 years ago)
Added
2024-04-08 (about 2 years ago)
Last Updated
2024-04-08 (about 2 years ago)

Other

Published
Title
Published
2025-01-16
Title
Contact Form 7 – CCAvenue Add-on <= 1.0 - Reflected Cross-Site Scripting
Published
2021-09-20
Title
Gutenberg PDF Viewer Block < 1.0.1 - Contributor+ Stored Cross-Site Scripting
Published
2026-02-19
Title
Quiz Maker < 6.7.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2022-05-09
Title
User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting
Published
2025-04-24
Title
Fable Extra < 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting