CVE-2021-24357: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24357 affects the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin versions before 2.0.35. The vulnerability was discovered and publicly disclosed on May 31, 2021, by security researcher avolume (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 5.5 (medium severity). The security flaw exists in the Custom CSS field of each gallery, which lacks proper sanitization and validation before being output on pages where the gallery is embedded. This vulnerability is categorized under CWE-79 and falls into the OWASP Top 10 category A7: Cross-Site Scripting (WPScan).

When exploited, this vulnerability allows attackers to inject malicious scripts through the Custom CSS field, which are then stored and executed when users view the affected gallery pages. This can lead to potential client-side attacks against users viewing the compromised gallery (WPScan).

The vulnerability requires authentication to exploit, as an attacker needs access to the gallery's Custom CSS field. The exploit can be triggered by creating or editing a gallery and inserting malicious code in the Custom CSS field, which then executes when users view the embedded gallery containing at least one image (WPScan).

The vulnerability has been fixed in FooGallery version 2.0.35. Users are advised to update their FooGallery plugin to this version or later to mitigate the security risk (WPScan).