CVE-2026-9134 Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter

🗓️ 13 Jun 2026 06:47:59Reported by WordfenceType

The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and including, 3.1.31 This is due to an incomplete JavaScript event handler blacklist in the foo...

Reporter	Title	Published	Views	Family All 4
CVE	CVE-2026-9134	13 Jun 202606:47	–	cve
EUVD	EUVD-2026-36645	13 Jun 202609:31	–	euvd
NVD	CVE-2026-9134	13 Jun 202607:16	–	nvd
Positive Technologies	PT-2026-49082	13 Jun 202600:00	–	ptsecurity

[
  {
    "vendor": "fooplugins",
    "product": "Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.1.31",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/foogallery/trunk/includes/functions.php
plugins	www.plugins.trac.wordpress.org/changeset/3542524/foogallery/tags/3.1.32/includes/functions.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/dd9650e6-7c3c-4510-9749-a3503924855f
plugins	www.plugins.trac.wordpress.org/browser/foogallery/trunk/includes/class-gallery-advanced-settings.php
plugins	www.plugins.trac.wordpress.org/browser/foogallery/trunk/includes/functions.php

13 Jun 2026 06:47Current

CVSS 3.16.4

CWE-79