The FooGallery WordPress plugin (versions up to 2.4.29) is vulnerable to stored cross-site scripting via the default_gallery_title_size parameter. This parameter is not properly sanitized or escaped, allowing authenticated users with specific roles to inject arbitrary JavaScript code. When other users access the injected gallery pages, the malicious scripts execute, potentially leading to session hijacking or other client-side impacts. The vulnerability requires low attack complexity and privileges limited to gallery and album creators. No user interaction is required beyond viewing the injected page.

Successful exploitation allows authenticated gallery or album creators to inject persistent malicious scripts into gallery pages. These scripts execute in the context of users viewing the pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability and requires authenticated access with specific roles, limiting its impact scope. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict gallery and album creator roles to trusted users only. Monitor for updates from FooPlugins regarding patches or official mitigations. Avoid granting unnecessary privileges that allow access to the vulnerable parameter.