CVE-2023-6747: FooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contributors and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6747?
CVE-2023-6747 is classified as medium severity due to the potential for stored Cross-Site Scripting vulnerabilities.
How do I fix CVE-2023-6747?
To fix CVE-2023-6747, update the FooGallery plugin to version 2.4.6 or later that includes fixes for the vulnerability.
Who is affected by CVE-2023-6747?
CVE-2023-6747 affects users of the FooGallery plugin for WordPress versions up to and including 2.3.3.
What type of vulnerability is CVE-2023-6747?
CVE-2023-6747 is a Stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escaping.
Can contributors exploit CVE-2023-6747?
Yes, contributors and higher user roles can exploit CVE-2023-6747 to inject malicious scripts via custom attributes.