FO
Vendor
FooPlugins
37
CVEs
0
On KEV
0
New 30D
Products
FO8.8
FooGallery
FooPlugins
17 CVEs0 on KEV0 new
GB5.4
Gallery by FooGallery
fooplugins
9 CVEs0 on KEV0 new
FO5.4
Foobox
Fooplugins
2 CVEs0 on KEV0 new
LM5.4
Lightbox & Modal Popup WordPress Plugin – FooBox
fooplugins
2 CVEs0 on KEV0 new
BW8.8
Best WordPress Gallery Plugin – FooGallery
FooPlugins
1 CVEs0 on KEV0 new
FI5.9
FooBox Image Lightbox
FooPlugins
1 CVEs0 on KEV0 new
FO4.8
Foobox-image-lightbox-premium
Fooplugins
1 CVEs0 on KEV0 new
GF6.4
Gallery : FooGallery
fooplugins
1 CVEs0 on KEV0 new
LA4.8
Lightbox And Modal Popup
Fooplugins
1 CVEs0 on KEV0 new
NB6.1
Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar
fooplugins
1 CVEs0 on KEV0 new
PG6.4
Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel
fooplugins
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85414 | GF Gallery : FooGallery fooplugins | 6.4 | Sep 5 | Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute |
| CVE-2026-9134 | PG Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel fooplugins | 6.4 | Jun 13 | Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter |
| CVE-2024-13362 | NB Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar fooplugins | 6.1 | May 1 | Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter |
| CVE-2026-25363 | FO FooGallery FooPlugins | 4.3 | Feb 19 | WordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerability |
| CVE-2026-25362 | FO FooGallery FooPlugins | 5.9 | Feb 19 | WordPress FooGallery plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-15524 | GB Gallery by FooGallery fooplugins | 4.3 | Feb 11 | Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure |
| CVE-2025-6068 | GB Gallery by FooGallery fooplugins | 5.4 | Jul 11 | FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
| CVE-2025-5537 | LM Lightbox & Modal Popup WordPress Plugin – FooBox fooplugins | 5.4 | Jul 8 | Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.34 - Authenticated (Author+) Stored Cross-Site Scripting |
| CVE-2025-32139 | FI FooBox Image Lightbox FooPlugins | 5.9 | Apr 10 | WordPress Lightbox & Modal Popup WordPress Plugin – FooBox plugin <= 2.7.33 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-12114 | GB Gallery by FooGallery fooplugins | 4.3 | Mar 8 | FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates |
| CVE-2024-12119 | GB Gallery by FooGallery fooplugins | 5.4 | Mar 8 | FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size |
| CVE-2023-6947 | FO Foogallery Fooplugins | 7.7 | Dec 10 | Best WordPress Gallery Plugin – FooGallery <= 2.4.16 - Authenticated (Contributor+) Directory Traversal |
| CVE-2024-5668 | LM Lightbox & Modal Popup WordPress Plugin – FooBox fooplugins | 5.4 | Aug 8 | Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes |
| CVE-2024-3276 | FO Foobox Fooplugins | 4.8 | Jun 18 | FooBox (Free and Premium) < 2.7.28 - Admin+ Stored XSS |
| CVE-2024-2122 | GB Gallery by FooGallery fooplugins | 5.4 | Jun 14 | FooGallery <= 2.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URL |
| CVE-2024-2762 | FO Foogallery Fooplugins | 5.4 | Jun 13 | FooGallery < 2.4.15 - Author+ Stored XSS |
| CVE-2024-2081 | GB Gallery by FooGallery fooplugins | 5.4 | Apr 9 | FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting |
| CVE-2024-2471 | GB Gallery by FooGallery fooplugins | 5.4 | Apr 6 | FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields |
| CVE-2024-0604 | GB Gallery by FooGallery fooplugins | 4.8 | Feb 20 | Best WordPress Gallery Plugin – FooGallery <= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settings |
| CVE-2023-6747 | GB Gallery by FooGallery fooplugins | 5.4 | Jan 3 | FooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2023-44233 | BW Best WordPress Gallery Plugin – FooGallery FooPlugins | 8.8 | Oct 6 | WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Request Forgery (CSRF) |
| CVE-2023-44244 | FO FooGallery FooPlugins | 6.1 | Oct 2 | WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-29439 | FO FooGallery FooPlugins | 6.1 | May 16 | WordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2021-24357 | FO Foogallery Fooplugins | 5.4 | Jun 14 | In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated… |
| CVE-2019-20182 | FO Foogallery Fooplugins | 4.8 | Jan 9 | The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter |