CVE-2026-9134 is a stored XSS vulnerability in the FooGallery plugin for WordPress, affecting versions <=3.1.31. The issue stems from the foogallery_sanitize_javascript() function which only blocks a subset of HTML event attributes, missing others like 'onmouseenter'. Additionally, the foogallery_build_container_attributes_safe() function fails to escape the 'custom_attribute_key' shortcode parameter properly when generating gallery container HTML. This combination allows authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript that executes in the context of users viewing the injected pages.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages using the vulnerable shortcode parameter. These scripts execute in the browsers of users who view the affected pages, potentially leading to session hijacking, defacement, or other actions permitted by the victim's browser context. The vulnerability does not require user interaction beyond viewing the page and does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the FooGallery plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.