PT-2025-8981 · Unknown · Foogallery

Andres Roldan · Published 2025-02-27 · Updated 2025-07-15 · CVE-2025-22624

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions FooGallery – Responsive Photo Gallery version 2.4.29

Description The issue arises from the web application dynamically generating web content without validating the source of potentially untrusted data. This is specifically noted in the file myapp/extensions/albums/admin/class-meta-boxes.php.

Recommendations For FooGallery – Responsive Photo Gallery version 2.4.29, consider restricting access to the class-meta-boxes.php file until a patch is available. As a temporary workaround, avoid using the class-meta-boxes.php file in the myapp/extensions/albums/admin directory to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22624

Affected Products

Foogallery

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-22624 · Security Note
• https://twitter.com/cybercronai/status/1895961140221337720 · Twitter Post
• https://twitter.com/fluidattacks/status/1900296056279040324 · Twitter Post
• https://wordpress.org/plugins/foogallery · Note
• https://t.me/cvedetector/19067 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1895404277301981686 · Twitter Post
• https://t.me/cvenotify/127219 · Telegram Post
• https://twitter.com/CVEnew/status/1895241175499710667 · Twitter Post
• https://fluidattacks.com/advisories/skims-10 · Note
• https://twitter.com/fluidattacks/status/1945245992569229659 · Twitter Post