Advisories · Technology

fooplugins Gallery by FooGallery.

Every CVE that names fooplugins Gallery by FooGallery among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-15524 CVE record

CVSS 4.3 Medium

Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure
- fooplugins Gallery by FooGallery
- Broken access control
Not analysed yet 11 Feb 2026
CVE-2025-6068 CVE record

CVSS 6.4 Medium

FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- fooplugins Gallery by FooGallery
- Cross-site scripting (XSS)
Not analysed yet 11 Jul 2025
CVE-2024-12114 CVE record

CVSS 4.3 Medium

FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates
- fooplugins Gallery by FooGallery
- Broken access control
Not analysed yet 8 Mar 2025
CVE-2024-12119 CVE record

CVSS 6.4 Medium

FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size
- fooplugins Gallery by FooGallery
- Cross-site scripting (XSS)
Not analysed yet 8 Mar 2025
CVE-2024-2122 CVE record

CVSS 6.4 Medium

FooGallery <= 2.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URL
- fooplugins Gallery by FooGallery
- Cross-site scripting (XSS)
Not analysed yet 14 Jun 2024
CVE-2024-2081 CVE record

CVSS 6.4 Medium

FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting
- fooplugins Gallery by FooGallery
- Cross-site scripting (XSS)
Not analysed yet 9 Apr 2024
CVE-2024-2471 CVE record

CVSS 6.4 Medium

FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields
- fooplugins Gallery by FooGallery
- Cross-site scripting (XSS)
Not analysed yet 6 Apr 2024
CVE-2024-0604 CVE record

CVSS 4.4 Medium

Best WordPress Gallery Plugin – FooGallery <= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settings
- fooplugins Gallery by FooGallery
- Cross-site scripting (XSS)
Not analysed yet 20 Feb 2024
CVE-2023-6747 CVE record

CVSS 6.4 Medium

FooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- https://fooplugins.com FooGallery Premium
- fooplugins Gallery by FooGallery
- Cross-site scripting (XSS)
Not analysed yet 3 Jan 2024