CVE-2023-29439: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions.

PriorityP336medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EXPLOIT

EPSS

1.75%

75.0th percentile

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FooPlugins FooGallery plugin <= 2.2.35 versions.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
fooplugins	foogallery	<= 2.2.35	—
fooplugins	foogallery	n/a – 2.2.35	—

Detection & IOCsextracted from sources · hover to see the quote

otheralert(document.domain)

sigma

words:
- 'foogallery-image-edit-modal'
condition: and
- type: word
  part: header
  words:
  - "text/html"
- type: status
  status:
  - 200

→Reflected XSS payload probe uses alert(document.domain) as the injected JavaScript, detectable in HTTP response body for unauthenticated requests to FooGallery plugin endpoints.
→Detection signature keys on the presence of 'foogallery-image-edit-modal' string in the HTTP response body, combined with Content-Type: text/html header and HTTP 200 status code.

·Vulnerability affects FooGallery plugin versions up to and including 2.2.35; ensure detection rules are scoped to these versions.

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.