CVE-2026-9134 affects FooGallery and is an authenticated Contributor+ Stored Cross-Site Scripting vulnerability in versions up to and including 3.1.31. A crafted custom_attribute_key shortcode parameter can create an onmouseenter handler on the gallery container, causing persistent JavaScript to run when a visitor moves the pointer over the gallery. The issue is fixed in version 3.1.32.
| CVE | CVE-2026-9134 |
| Plugin Version | FooGallery <= 3.1.31, fixed in 3.1.32 |
| All Time | 6 638 463 |
| Active installations | 100 000+ |
| Publicly Published | June 12, 2026 |
| Last Updated | June 13, 2026 |
| Researcher | Dmitrii Ignatyev |
| CWE | CWE-79 |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-9134 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/foogallery/photo-gallery-by-foogallery-responsive-image-gallery-masonry-gallery-carousel-3131-authenticated-contributor-stored-cross-site-scripting-via-custom-attribute-key-shortcode-parameter |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| April 16, 2026 | Plugin testing and vulnerability detection in FooGallery were completed. |
| April 16, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| June 12, 2026 | CVE-2026-9134 was publicly published by Wordfence. |
Discovery of the Vulnerability
The vulnerable flow begins when FooGallery processes custom_attribute_key and custom_attribute_value from the foogallery shortcode. In versions through 3.1.31, foogallery_sanitize_javascript() relies on an incomplete blacklist of JavaScript event attributes. It rejects several common event names but permits onmouseenter.
The accepted key is later used while foogallery_build_container_attributes_safe() constructs attributes for the gallery container. Because the attribute name is not restricted to a safe allowlist, a Contributor can store an event handler in post content. Once an authorized user publishes or previews the post, the handler becomes active in the rendered gallery.
Understanding of Stored Cross-Site Scripting attacks
Stored Cross-Site Scripting occurs when attacker-controlled input is saved by the application and later rendered in a browser-executable context. Blocking a short list of event names is fragile because HTML supports many event attributes. A less common handler can reach the page even when familiar names such as onclick or onmouseover are rejected.
A Contributor cannot normally publish posts on a default WordPress installation, but can prepare content for review. If an editor previews or publishes the crafted post, the payload persists in the shortcode and executes for users who interact with the gallery. Code running in an administrator’s browser can abuse actions available to that signed-in session.
Exploiting the Stored Cross-Site Scripting Vulnerability
A Contributor or higher can place the following shortcode in a post on a site running FooGallery 3.1.31 or earlier. After the post is rendered, moving the pointer over the gallery container triggers the harmless alert.
POC:
POC: [foogallery template="default" attachment_ids="906" custom_attribute_key="onmouseenter" custom_attribute_value="alert(document.domain)"]____
The alert displays the current document domain and demonstrates JavaScript execution without changing site data or configuration. The injected handler remains stored with the post until the shortcode is removed or the plugin blocks the unsafe attribute name.
Recommendations for Improved Security
Site owners should update FooGallery to version 3.1.32 or later. Until the update is applied, review Contributor-authored content before publication and remove foogallery shortcodes that define custom attribute keys beginning with on. A restrictive Content Security Policy can reduce impact but does not replace the plugin update.
Developers should validate custom attribute names against a strict allowlist instead of trying to enumerate dangerous event handlers. Event attributes must be rejected after normalization, and attribute values should be escaped for their HTML context before output.
By addressing Stored Cross-Site Scripting issues like CVE-2026-9134, WordPress site owners can prevent low-privileged shortcode content from becoming a persistent browser-side execution path. Stay vigilant, stay secure.
#WordPressSecurity #StoredXSS #FooGallery #ShortcodeSecurity #WebsiteSafety #StayProtected #MediumVulnerability
Use CleanTalk solutions to improve the security of your website
