CVE-2026-9134 is a stored XSS vulnerability in the FooGallery plugin for WordPress, specifically in the handling of the 'custom_attribute_key' shortcode parameter. The vulnerability is due to an incomplete JavaScript event handler blacklist in the foogallery_sanitize_javascript() function, which blocks only certain event attributes but allows others like 'onmouseenter'. Additionally, the attribute key is not escaped properly in foogallery_build_container_attributes_safe(), enabling injection of arbitrary scripts. This allows authenticated attackers with contributor or higher privileges to inject scripts that execute in the context of users viewing the injected pages.

An attacker with contributor-level or higher access can inject malicious JavaScript into pages via the vulnerable shortcode parameter. This script executes in the browsers of users who visit the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity) with network attack vector, low attack complexity, and no user interaction required.

No official patch or remediation level is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict contributor-level access to trusted users and consider disabling or removing the FooGallery plugin if possible. Avoid using the 'custom_attribute_key' shortcode parameter or sanitize inputs manually if feasible.