CVE-2026-85414: FooGallery WordPress Plugin XSS Vulnerability

CVE-2026-85414 Overview

CVE-2026-85414 is a Stored Cross-Site Scripting (XSS) vulnerability in the FooGallery plugin for WordPress, affecting all versions up to and including 3.3.2. The flaw resides in the handling of the custom_settings shortcode attribute, where the plugin fails to properly sanitize input and escape output. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript that executes in the browser of any user who views the affected page. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript into gallery pages, enabling session theft, administrative account takeover, and drive-by redirects against site visitors and administrators.

Affected Products

FooGallery plugin for WordPress, all versions up to and including 3.3.2
Vulnerable code paths in includes/class-gallery-advanced-settings.php and includes/functions.php
Client-side rendering routines in assets/js/foogallery.4cc6f51b.js

Discovery Timeline

2026-09-05 - CVE-2026-85414 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85414

Vulnerability Analysis

The FooGallery plugin exposes a [foogallery] shortcode that accepts a custom_settings attribute. The plugin passes this attribute through to gallery rendering logic without applying sufficient sanitization on input or escaping on output. When the shortcode renders on a published page, the attacker-supplied value is emitted into the page context where a browser interprets it as executable script.

Because the payload is stored in post content, execution is persistent. Every visitor who loads the affected page triggers the payload, including administrators. According to the Wordfence advisory, the attack requires contributor-level authentication or higher, which is a low bar on many multi-author WordPress sites.

Root Cause

The root cause is missing input sanitization and missing output escaping around the custom_settings shortcode attribute. Server-side handling in class-gallery-advanced-settings.php and helper routines in functions.php accept attacker-controlled values and forward them into rendering paths. The client-side JavaScript in foogallery.4cc6f51b.js then consumes these values without treating them as untrusted data. Neither wp_kses_post() nor context-aware escaping such as esc_attr() or esc_html() is applied before the value is written to the DOM.

Attack Vector

Exploitation requires an authenticated account with contributor privileges. The attacker creates or edits a post that embeds the [foogallery] shortcode with a malicious custom_settings payload. When the post is viewed by any visitor, including higher-privileged users such as editors or administrators, the injected script executes in their browser session. This enables actions such as CSRF token theft, cookie exfiltration, forced administrative operations, and content defacement. The scope-changed impact reflected in the CVSS vector indicates the payload affects users beyond the vulnerable component.

No publicly weaponized exploit code is currently listed. See the WordPress FooGallery source tree and the remediation changeset 3680965 for the affected and patched code paths.

Detection Methods for CVE-2026-85414

Indicators of Compromise

Posts or pages containing [foogallery] shortcodes with custom_settings values that include <script>, on*= event handlers, javascript: URIs, or encoded variants such as <script>
Recently created or modified content authored by low-privilege contributor accounts that embeds FooGallery shortcodes
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after viewing gallery pages

Detection Strategies

Query the wp_posts table for post content matching custom_settings= combined with script or event-handler patterns
Review WordPress audit logs for contributor-role users editing published pages that render for administrators
Inspect server access logs for suspicious query strings and referrers correlated with gallery page views

Monitoring Recommendations

Enable a WordPress activity logging plugin to track shortcode edits by contributor and author roles
Deploy a web application firewall with rules that flag script tags and event handlers inside shortcode attributes
Monitor browser telemetry from administrator workstations for anomalous script execution or unexpected fetches originating from the WordPress admin domain

How to Mitigate CVE-2026-85414

Immediate Actions Required

Update the FooGallery plugin to the version that includes changeset 3680965, which fixes the sanitization gap
Audit all posts and pages containing FooGallery shortcodes and remove any custom_settings values that contain script content
Review contributor and author accounts, rotate credentials for any accounts showing suspicious edits, and enforce multi-factor authentication

Patch Information

The vendor addressed the issue in the FooGallery release that supersedes version 3.3.2. The fix is documented in WordPress plugin changeset 3680965. Site operators should upgrade through the WordPress plugin dashboard or via WP-CLI and confirm the installed version reports higher than 3.3.2. Refer to the Wordfence Vulnerability Report for vendor coordination details.

Workarounds

Temporarily restrict the FooGallery shortcode to trusted roles by removing contributor and author capability to publish posts containing gallery shortcodes
Deploy a WAF rule that blocks HTTP requests containing custom_settings attribute values with <, >, or on\w+= patterns
Implement a Content Security Policy that disallows inline scripts on public pages to reduce the impact of stored XSS payloads

bash

# Configuration example
wp plugin update foogallery
wp plugin get foogallery --field=version

# Search posts for potentially malicious FooGallery shortcodes
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content REGEXP 'foogallery[^]]*custom_settings=[^]]*<' AND post_status='publish';"