Log in Start free

FooPlugins

Products

ProductCVEsExploitedLatest
Gallery by FooGallery9–Feb 11, 2026
FooGallery4–Feb 19, 2026
Lightbox & Modal Popup WordPress Plugin – FooBox2–Jul 8, 2025
Gallery : FooGallery1–Sep 5, 2026
Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar1–May 1, 2026
Best Image Gallery & Responsive Photo Gallery – FooGallery1–Jun 14, 2021
Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel1–Jun 13, 2026
Best WordPress Gallery Plugin – FooGallery1–Oct 6, 2023
FooBox Image Lightbox1–Apr 10, 2025

Exploited and recent CVEs

  • CVE-2026-85414 Medium 6.4 Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute 0.4%
  • CVE-2026-9134 Medium 6.4 Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter 0.3%
  • CVE-2024-13362 Medium 6.1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter 0.3%
  • CVE-2026-25363 Medium 4.3 WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability 0.2%
  • CVE-2026-25362 Medium 5.9 WordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-15524 Medium 4.3 Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure 0.2%
  • CVE-2025-6068 Medium 6.4 FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting 0.2%
  • CVE-2025-5537 Medium 6.4 Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.34 - Authenticated (Author+) Stored Cross-Site Scripting 0.2%
  • CVE-2025-32139 Medium 5.9 WordPress Lightbox & Modal Popup WordPress Plugin – FooBox plugin <= 2.7.33 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-12114 Medium 4.3 FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates 0.3%
  • CVE-2024-12119 Medium 6.4 FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size 0.3%
  • CVE-2024-5668 Medium 6.4 Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes 0.3%
  • CVE-2024-2122 Medium 6.4 FooGallery <= 2.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URL 0.5%
  • CVE-2024-2081 Medium 6.4 FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting 0.6%
  • CVE-2024-2471 Medium 6.4 FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields 0.3%
  • CVE-2024-0604 Medium 4.4 Best WordPress Gallery Plugin – FooGallery <= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settings 0.6%
  • CVE-2023-6747 Medium 6.4 FooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
  • CVE-2023-44233 Medium 5.4 WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%
  • CVE-2023-44244 High 7.1 WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Scripting (XSS) 0.4%
  • CVE-2023-29439 High 7.1 WordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS) 1.7%
  • CVE-2021-24357 Unrated FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting 0.6%