6.4
Medium
CVE-2024-2471 The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as…
Description
The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type') in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Best WordPress Gallery Plugin – FooGallery 2.4 | earliest → 2.4.14 | No fix stated |
| Gallery by FooGallery 2.4 | earliest → 2.4.14 | No fix stated |
Other CVEs of Best WordPress Gallery Plugin – FooGallery
The 4 CVEs of Best WordPress Gallery Plugin – FooGallery →
CVE-2024-2081
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
6.4
Medium
CVE-2024-0604
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
4.4
Medium
CVE-2023-6747
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
6.4
Medium