Fooplugins
21 CVEs across 9 Fooplugins products. Browse Fooplugins vulnerabilities, severities, and proof-of-concept exploits.
Fooplugins products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9134 | Medium | 6.4 | 2026-06-13 | The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and incl… |
CVE-2024-13362 | Medium | 6.1 | 2026-05-01 | Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient inp… |
CVE-2026-25363 | Medium | 4.3 | 2026-02-19 | Missing Authorization vulnerability in FooPlugins FooGallery foogallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-25362 | Medium | 5.9 | 2026-02-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooGallery foogallery allows Stored XSS.This i… |
CVE-2025-15524 | Medium | 4.3 | 2026-02-11 | The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax_get_gallery_info() fu… |
CVE-2025-6068 | Medium | 6.4 | 2025-07-11 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2025-5537 | Medium | 6.4 | 2025-07-08 | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versi… |
CVE-2025-32139 | Medium | 5.9 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooBox Image Lightbox foobox-image-lightbox.T… |
CVE-2024-12119 | Medium | 6.4 | 2025-03-08 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2024-12114 | Medium | 4.3 | 2025-03-08 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference i… |
CVE-2023-6947 | High | 7.7 | 2024-12-10 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This mak… |
CVE-2022-4974 | Medium | 6.3 | 2024-10-16 | The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to… |
CVE-2024-5668 | Medium | 6.4 | 2024-08-08 | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in al… |
CVE-2024-3276 | Medium | 4.8 | 2024-06-18 | The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and… |
CVE-2024-2122 | Medium | 6.4 | 2024-06-14 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom URLs in all versions… |
CVE-2024-2762 | Medium | 5.4 | 2024-06-13 | The FooGallery WordPress plugin before 2.4.15, foogallery-premium WordPress plugin before 2.4.15 does not validate and escape some of its Gallery settings bef… |
CVE-2024-2081 | Medium | 6.4 | 2024-04-09 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the foogallery_attachment_modal_save actio… |
CVE-2024-2471 | Medium | 6.4 | 2024-04-06 | The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as 'Title', 'Alt Text', 'Custom URL', 'Custo… |
CVE-2024-0604 | Medium | 4.4 | 2024-02-29 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and… |
CVE-2023-6747 | Medium | 6.4 | 2024-01-03 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up t… |
CVE-2023-44233 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions. |
CVE-2023-44244 | High | 7.1 | 2023-10-02 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.44 versions. |
CVE-2023-29439 | High | 7.1 | 2023-05-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions. |
CVE-2021-24357 | Medium | 5.4 | 2021-06-14 | In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitise… |
CVE-2019-20182 | Medium | 4.8 | 2020-01-09 | The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. |