CVE-2026-9134: FooGallery WordPress Plugin Stored XSS Vulnerability

Technical summary

CVE-2026-9134 is a Stored XSS flaw in FooGallery versions up to 3.1.31. The vulnerability stems from two design flaws in the shortcode processing: (1) the foogallery_sanitize_javascript() function implements an incomplete blocklist of HTML event attributes, allowing onmouseenter and similar handlers to bypass filtering; and (2) the foogallery_build_container_attributes_safe() function fails to properly escape attribute keys when constructing gallery container HTML. An authenticated attacker with contributor-level or higher permissions can craft a malicious shortcode with a custom_attribute_key parameter containing event handler markup. Because the unsafe attribute key is directly inserted into the HTML output and stored in the database, the payload persists and executes whenever any user visits the affected page.

Business impact

Organizations relying on FooGallery risk content compromise and user trust degradation. Attackers with contributor access—a common privilege level for content teams—can silently inject credential-harvesting payloads, malware redirects, or keyloggers into published pages. This affects visitor trust, potential regulatory exposure if user data is compromised, and operational overhead in incident response and content remediation.

Affected systems

FooGallery WordPress plugin version 3.1.31 and earlier are affected. The vulnerability requires an authenticated attacker with at least contributor-level access, meaning WordPress users with the ability to create or edit posts and pages can exploit this flaw. Sites running FooGallery for image galleries are in scope if they grant contributor roles to multiple team members or third-party content creators.

Exploitability

Exploitation requires valid WordPress credentials at contributor level or above—a relatively low bar in multi-author environments. No network-level interaction or complex social engineering is needed; an attacker can inject the payload directly via the WordPress admin interface. Once stored, the payload executes automatically for all site visitors, amplifying impact without requiring re-exploitation. The incomplete event handler blocklist suggests the developers attempted sanitization but did not account for the full range of HTML event attributes, making the bypass straightforward for someone familiar with event-driven JavaScript.

Remediation

Update FooGallery to a patched version after 3.1.31 (verify against the vendor advisory for the specific release that addresses this flaw). Additionally, audit contributor-level permissions across your WordPress installation and restrict the ability to create or edit posts containing FooGallery shortcodes to trusted personnel only. For WordPress sites where FooGallery is not actively used, deactivate and remove the plugin.

Patch guidance

Patching is the primary remediation. Check the FooGallery release notes and security advisories on the plugin's official repository or vendor website for the first version after 3.1.31 that includes a fix. The fix should both complete the event handler blocklist in sanitization logic and ensure proper HTML escaping of attribute keys. Update via the WordPress admin dashboard or directly download from the official plugin source. After updating, verify that no malicious shortcodes remain in your posts and pages (use the WordPress plugin search or database queries to find instances of custom_attribute_key parameters).

Detection guidance

Search your WordPress database for posts and pages containing FooGallery shortcodes with suspicious custom_attribute_key parameters, especially those containing 'on' prefixes followed by event names (onmouseenter, onmousemove, onwheel, etc.). Use WordPress audit logs or security plugins (e.g., Wordfence, Sucuri) to identify post revisions created by contributor-level users around the time of suspected compromise. Monitor browser console logs and network traffic on affected pages for unexpected JavaScript execution. Review access logs for unusual patterns of contributor account activity.

Why prioritize this

Although listed as MEDIUM severity (CVSS 6.4), the practical risk is significant in multi-author WordPress environments. The vulnerability combines persistent stored XSS (high impact) with relatively permissive access requirements (authenticated, contributor-level). Unlike a reflected XSS that requires social engineering, this flaw allows any trusted contributor to silently compromise pages viewed by thousands of visitors. Organizations should prioritize patching contributor-accessible plugins within their standard maintenance windows.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects network-accessible attack vector (AV:N), low complexity (AC:L), and low privilege requirement (PR:L), balanced against limited confidentiality and integrity impact (C:L, I:L) and no availability impact (A:N). The score appropriately captures the cross-site (S:C) nature of the attack but may underweight the practical persistence and user-facing consequences of stored XSS in a CMS context. For risk prioritization, consider raising the internal priority if your WordPress installation grants contributor roles broadly or hosts sensitive content.

Frequently asked questions