The FooGallery WordPress plugin versions up to 2.4.14 contain a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the foogallery_attachment_modal_save action does not sufficiently sanitize or escape user input, allowing authenticated users with author-level access or higher to inject arbitrary JavaScript code. This code executes in the context of users who view the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is network exploitable with low attack complexity and no user interaction required beyond authentication. The CVSS 3.1 base score is 6.4, reflecting limited confidentiality and integrity impact but no availability impact.

An attacker with author-level or higher privileges can inject persistent malicious scripts into pages generated by the FooGallery plugin. These scripts execute in the browsers of users who access the compromised pages, potentially enabling theft of session tokens, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and monitor for suspicious activity related to FooGallery plugin usage. Avoid exposing the foogallery_attachment_modal_save action to untrusted users. Follow vendor channels for updates and apply patches promptly once available.