Vulnerability Details CVE-2024-2471
The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image attachment fields (such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type') in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 24.5%
CVSS Severity
CVSS v3 Score 6.4
References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3061049%40foogallery&old=3039399%40foogallery&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d4aeb1-0a4f-49f1-b5a9-b582e271eae1?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3061049%40foogallery&old=3039399%40foogallery&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d4aeb1-0a4f-49f1-b5a9-b582e271eae1?source=cve
Products affected by CVE-2024-2471
-
cpe:2.3:a:fooplugins:foogallery:-
-
cpe:2.3:a:fooplugins:foogallery:1.1.7
-
cpe:2.3:a:fooplugins:foogallery:1.1.8
-
cpe:2.3:a:fooplugins:foogallery:1.1.8.1
-
cpe:2.3:a:fooplugins:foogallery:1.1.8.2
-
cpe:2.3:a:fooplugins:foogallery:1.10.0
-
cpe:2.3:a:fooplugins:foogallery:1.10.1
-
cpe:2.3:a:fooplugins:foogallery:1.10.3
-
cpe:2.3:a:fooplugins:foogallery:1.10.4
-
cpe:2.3:a:fooplugins:foogallery:1.2.0
-
cpe:2.3:a:fooplugins:foogallery:1.2.1
-
cpe:2.3:a:fooplugins:foogallery:1.2.10
-
cpe:2.3:a:fooplugins:foogallery:1.2.11
-
cpe:2.3:a:fooplugins:foogallery:1.2.12
-
cpe:2.3:a:fooplugins:foogallery:1.2.13
-
cpe:2.3:a:fooplugins:foogallery:1.2.15
-
cpe:2.3:a:fooplugins:foogallery:1.2.16
-
cpe:2.3:a:fooplugins:foogallery:1.2.17
-
cpe:2.3:a:fooplugins:foogallery:1.2.18
-
cpe:2.3:a:fooplugins:foogallery:1.2.19
-
cpe:2.3:a:fooplugins:foogallery:1.2.20
-
cpe:2.3:a:fooplugins:foogallery:1.2.4
-
cpe:2.3:a:fooplugins:foogallery:1.2.5
-
cpe:2.3:a:fooplugins:foogallery:1.2.6
-
cpe:2.3:a:fooplugins:foogallery:1.2.7
-
cpe:2.3:a:fooplugins:foogallery:1.2.8
-
cpe:2.3:a:fooplugins:foogallery:1.2.9
-
cpe:2.3:a:fooplugins:foogallery:1.3.28
-
cpe:2.3:a:fooplugins:foogallery:1.3.6
-
cpe:2.3:a:fooplugins:foogallery:1.3.7
-
cpe:2.3:a:fooplugins:foogallery:1.3.8
-
cpe:2.3:a:fooplugins:foogallery:1.4.12
-
cpe:2.3:a:fooplugins:foogallery:1.4.14
-
cpe:2.3:a:fooplugins:foogallery:1.4.15
-
cpe:2.3:a:fooplugins:foogallery:1.4.25
-
cpe:2.3:a:fooplugins:foogallery:1.4.26
-
cpe:2.3:a:fooplugins:foogallery:1.4.27
-
cpe:2.3:a:fooplugins:foogallery:1.4.29
-
cpe:2.3:a:fooplugins:foogallery:1.4.3
-
cpe:2.3:a:fooplugins:foogallery:1.4.30
-
cpe:2.3:a:fooplugins:foogallery:1.4.31
-
cpe:2.3:a:fooplugins:foogallery:1.4.4
-
cpe:2.3:a:fooplugins:foogallery:1.4.5
-
cpe:2.3:a:fooplugins:foogallery:1.4.6
-
cpe:2.3:a:fooplugins:foogallery:1.4.7
-
cpe:2.3:a:fooplugins:foogallery:1.4.8
-
cpe:2.3:a:fooplugins:foogallery:1.5.8
-
cpe:2.3:a:fooplugins:foogallery:1.5.9
-
cpe:2.3:a:fooplugins:foogallery:1.6.1
-
cpe:2.3:a:fooplugins:foogallery:1.6.10
-
cpe:2.3:a:fooplugins:foogallery:1.6.11
-
cpe:2.3:a:fooplugins:foogallery:1.6.13
-
cpe:2.3:a:fooplugins:foogallery:1.6.14
-
cpe:2.3:a:fooplugins:foogallery:1.6.15
-
cpe:2.3:a:fooplugins:foogallery:1.6.17
-
cpe:2.3:a:fooplugins:foogallery:1.6.7
-
cpe:2.3:a:fooplugins:foogallery:1.7.4
-
cpe:2.3:a:fooplugins:foogallery:1.7.6
-
cpe:2.3:a:fooplugins:foogallery:1.7.7
-
cpe:2.3:a:fooplugins:foogallery:1.7.8
-
cpe:2.3:a:fooplugins:foogallery:1.8.11
-
cpe:2.3:a:fooplugins:foogallery:1.8.12
-
cpe:2.3:a:fooplugins:foogallery:1.8.14
-
cpe:2.3:a:fooplugins:foogallery:1.8.18
-
cpe:2.3:a:fooplugins:foogallery:1.8.20
-
cpe:2.3:a:fooplugins:foogallery:1.8.8
-
cpe:2.3:a:fooplugins:foogallery:1.9.11
-
cpe:2.3:a:fooplugins:foogallery:1.9.23
-
cpe:2.3:a:fooplugins:foogallery:1.9.24
-
cpe:2.3:a:fooplugins:foogallery:1.9.28
-
cpe:2.3:a:fooplugins:foogallery:1.9.30
-
cpe:2.3:a:fooplugins:foogallery:1.9.31
-
cpe:2.3:a:fooplugins:foogallery:1.9.34
-
cpe:2.3:a:fooplugins:foogallery:1.9.35
-
cpe:2.3:a:fooplugins:foogallery:1.9.36
-
cpe:2.3:a:fooplugins:foogallery:1.9.37
-
cpe:2.3:a:fooplugins:foogallery:1.9.38
-
cpe:2.3:a:fooplugins:foogallery:1.9.39
-
cpe:2.3:a:fooplugins:foogallery:1.9.40
-
cpe:2.3:a:fooplugins:foogallery:1.9.44
-
cpe:2.3:a:fooplugins:foogallery:1.9.45
-
cpe:2.3:a:fooplugins:foogallery:1.9.46
-
cpe:2.3:a:fooplugins:foogallery:1.9.47
-
cpe:2.3:a:fooplugins:foogallery:1.9.48
-
cpe:2.3:a:fooplugins:foogallery:1.9.49
-
cpe:2.3:a:fooplugins:foogallery:1.9.50
-
cpe:2.3:a:fooplugins:foogallery:1.9.52
-
cpe:2.3:a:fooplugins:foogallery:1.9.53
-
cpe:2.3:a:fooplugins:foogallery:1.9.8
-
cpe:2.3:a:fooplugins:foogallery:2.0.20
-
cpe:2.3:a:fooplugins:foogallery:2.0.24
-
cpe:2.3:a:fooplugins:foogallery:2.0.30
-
cpe:2.3:a:fooplugins:foogallery:2.0.35
-
cpe:2.3:a:fooplugins:foogallery:2.0.39
-
cpe:2.3:a:fooplugins:foogallery:2.1.18
-
cpe:2.3:a:fooplugins:foogallery:2.1.24
-
cpe:2.3:a:fooplugins:foogallery:2.1.28
-
cpe:2.3:a:fooplugins:foogallery:2.1.33
-
cpe:2.3:a:fooplugins:foogallery:2.1.34
-
cpe:2.3:a:fooplugins:foogallery:2.1.35
-
cpe:2.3:a:fooplugins:foogallery:2.2.16
-
cpe:2.3:a:fooplugins:foogallery:2.2.20
-
cpe:2.3:a:fooplugins:foogallery:2.2.22
-
cpe:2.3:a:fooplugins:foogallery:2.2.26
-
cpe:2.3:a:fooplugins:foogallery:2.2.35
-
cpe:2.3:a:fooplugins:foogallery:2.2.41
-
cpe:2.3:a:fooplugins:foogallery:2.2.42
-
cpe:2.3:a:fooplugins:foogallery:2.2.44
-
cpe:2.3:a:fooplugins:foogallery:2.2.6
-
cpe:2.3:a:fooplugins:foogallery:2.2.7
-
cpe:2.3:a:fooplugins:foogallery:2.2.8
-
cpe:2.3:a:fooplugins:foogallery:2.3.2
-
cpe:2.3:a:fooplugins:foogallery:2.3.3
-
cpe:2.3:a:fooplugins:foogallery:2.3.4
-
cpe:2.3:a:fooplugins:foogallery:2.4.0.1
-
cpe:2.3:a:fooplugins:foogallery:2.4.1
-
cpe:2.3:a:fooplugins:foogallery:2.4.2
-
cpe:2.3:a:fooplugins:foogallery:2.4.5
-
cpe:2.3:a:fooplugins:foogallery:2.4.6
-
cpe:2.3:a:fooplugins:foogallery:2.4.7