The vulnerability in the FooGallery WordPress plugin allows an authenticated user with contributor or higher privileges to inject malicious JavaScript into pages. By supplying a specially crafted value in the 'custom_attribute_key' shortcode parameter, the attacker exploits a missing event‑handler blacklist and an uncoded attribute key when the gallery container is rendered. The injected script runs on page load for any visitor, enabling potential defacement, credential theft, cookie hijacking, and other browser‑based attacks that compromise confidentiality and integrity of the site and its users.

All installations of the "Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel" plugin with a version of 3.1.31 or earlier are affected. The issue has been fixed in version 3.1.32 and later; any site still running a vulnerable release is at risk.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available, so the current likelihood of exploitation is uncertain, but the vulnerability is not listed in CISA KEV. Attackers must be authenticated and have contributor‑level access to inject the payload, meaning the risk is limited to sites that grant such privileges. Once injected, the exploit is client‑side and can impact every user who views the affected page.