CVE-2026-9134: FooGallery WordPress Plugin XSS Vulnerability

CVE-2026-9134 Overview

CVE-2026-9134 is a Stored Cross-Site Scripting (XSS) vulnerability in the FooGallery plugin for WordPress, affecting all versions up to and including 3.1.31. The flaw resides in the custom_attribute_key shortcode parameter and stems from an incomplete JavaScript event handler blacklist in the foogallery_sanitize_javascript() function. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes in any visitor's browser when they view an affected page. The issue is tracked under CWE-79 and was patched in FooGallery version 3.1.32.

Critical Impact
Authenticated contributors can persist malicious JavaScript in gallery pages, enabling session theft, administrative account takeover, and arbitrary actions in the context of any authenticated visitor.

Affected Products

FooGallery plugin for WordPress, versions ≤ 3.1.31
WordPress sites running FooGallery with contributor-or-higher user accounts
Pages and posts rendering FooGallery shortcodes with attacker-supplied custom_attribute_key values

Discovery Timeline

2026-06-13 - CVE-2026-9134 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-9134

Vulnerability Analysis

The vulnerability is a Stored XSS condition in FooGallery's shortcode rendering pipeline. FooGallery accepts a custom_attribute_key shortcode parameter that is intended to allow administrators to define custom HTML attributes on the gallery container element. When the gallery is rendered, the supplied key is concatenated into HTML output without proper escaping, while the value is filtered through a sanitization routine designed to strip JavaScript event handlers.

The sanitizer, foogallery_sanitize_javascript(), only blocks a fixed subset of event attribute names: onmouseover, onmouseout, onpointerenter, onclick, onload, onchange, and onerror. Common handlers such as onmouseenter, onfocus, onanimationstart, and onpointerdown pass through unfiltered. Because the attribute key itself is also unescaped during HTML construction, attackers can inject an arbitrary attribute name, including event handlers and their JavaScript payload.

Root Cause

The root cause is twofold. First, foogallery_sanitize_javascript() implements a denylist of event handler names rather than an allowlist of permitted attributes. Denylist sanitization for HTML event handlers is brittle because the HTML specification defines a large and growing set of on* handlers. Second, foogallery_build_container_attributes_safe() fails to apply esc_attr() or equivalent escaping to the attribute key when assembling the container's opening tag, allowing the key portion to break out of the intended attribute context.

Attack Vector

An attacker with contributor-level or higher access authors a post containing a FooGallery shortcode whose custom_attribute_key parameter is crafted to introduce a permitted-by-bypass event handler such as onmouseenter, paired with a JavaScript payload. When the post is viewed, including by an administrator previewing pending submissions, the injected script executes in the visitor's browser under the site's origin. The scope-changed impact (S:C in the CVSS vector) reflects that script execution affects users beyond the attacker's own privilege boundary, enabling session token theft, forced administrative actions via the WordPress REST API, or persistent backdoor installation.

No verified public exploit code is available. Technical details and the patch diff are documented in the Wordfence Vulnerability Report and the FooGallery 3.1.32 Changeset.

Detection Methods for CVE-2026-9134

Indicators of Compromise

Post or page content containing [foogallery] shortcodes with a custom_attribute_key parameter referencing event handler names such as onmouseenter, onfocus, onanimationstart, or similar on* strings.
Rendered HTML on gallery pages where the .foogallery container element carries unexpected on* attributes pointing to inline JavaScript.
Database rows in wp_posts whose post_content includes FooGallery shortcodes with suspicious custom_attribute_key values containing =, quotes, or javascript: URIs.

Detection Strategies

Audit the WordPress database for any FooGallery shortcode usage with the custom_attribute_key parameter and review the value for handler-style strings.
Inspect rendered gallery pages with a headless browser or DOM scanner to surface inline event handler attributes that were not authored intentionally.
Review user account activity for contributor-level accounts that have created or edited posts containing FooGallery shortcodes, particularly accounts created shortly before suspicious posts.

Monitoring Recommendations

Enable WordPress audit logging to record post creation and edits by contributor and author roles, including diff capture of post_content.
Monitor web server access logs for elevated traffic to gallery-containing URLs and outbound requests from visitor browsers to attacker-controlled domains.
Track Content Security Policy (CSP) violation reports for inline-script blocks on gallery pages as a signal of injection attempts.

How to Mitigate CVE-2026-9134

Immediate Actions Required

Update the FooGallery plugin to version 3.1.32 or later on every WordPress site in the environment.
Review and remove any unauthorized contributor, author, or editor accounts, and rotate credentials for legitimate low-privilege users.
Inspect existing posts and pages for FooGallery shortcodes containing the custom_attribute_key parameter and remove any with suspicious values.
Invalidate active administrator sessions and rotate WordPress salts in wp-config.php if injection is suspected.

Patch Information

The vendor released FooGallery 3.1.32 to address CVE-2026-9134. The fix is documented in the FooGallery 3.1.32 Changeset and tightens both the event handler filter in foogallery_sanitize_javascript() and the attribute escaping logic referenced in functions.php line 1516 and functions.php line 480.

Workarounds

Restrict contributor, author, and editor roles to trusted users only until the patch is applied.
Disable the FooGallery plugin on sites where immediate patching is not possible.
Deploy a Web Application Firewall (WAF) rule that blocks requests containing FooGallery shortcodes with custom_attribute_key values matching on\w+\s*=.
Apply a strict Content Security Policy that disallows inline event handlers and inline scripts on public-facing pages.

bash

# Verify the installed FooGallery version via WP-CLI and update
wp plugin get foogallery --field=version
wp plugin update foogallery --version=3.1.32

# Search the database for shortcodes carrying the vulnerable parameter
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%[foogallery%custom_attribute_key%';"