The FooGallery WordPress plugin versions up to 2.4.7 contain a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts via the plugin's admin settings, which execute when users visit the injected pages. This vulnerability affects multi-site WordPress setups and installations with unfiltered_html disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges without user interaction.

Successful exploitation allows an authenticated administrator to inject and execute arbitrary JavaScript in the context of affected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions within the WordPress environment. The impact is limited to multi-site installations or those with unfiltered_html disabled. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or limiting the use of the FooGallery plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once released.