CVE-2023-29439

Deeper analysis

CVE-2023-29439 is an unauthenticated reflected cross-site scripting vulnerability affecting the FooPlugins FooGallery WordPress plugin in versions up to and including 2.2.35. The flaw, tracked under CWE-79, carries a CVSS 3.1 base score of 7.1 and stems from improper handling of user-supplied input that is subsequently reflected back to victims without adequate sanitization.

An attacker can exploit the issue by crafting a malicious URL and inducing a targeted user to click it, resulting in execution of arbitrary script code in the victim's browser context. Because the attack requires no authentication and leverages the plugin's public-facing endpoints, successful exploitation can lead to theft of session tokens, defacement, or redirection to malicious sites while operating with the changed scope noted in the CVSS vector.

The EPSS score for this CVE reached a peak of 0.7175 and currently stands at 0.6537, indicating sustained but moderate exploitation interest after public disclosure. Public references including Patchstack and technical write-ups provide further details on the affected code paths but do not describe specific mitigation steps beyond the standard recommendation to update the plugin once a fixed release is issued.