CVE-2025-2269

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter

View on CVE.org

Published Apr 11, 2025 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.

Analysis

Technical impact

The Photo Gallery by 10Web – Mobile‑Friendly Image Gallery plugin for WordPress is vulnerable to Reflected XSS through the image_id parameter because the input is not sanitized and the output is not escaped. When an attacker can entice an administrative user to click a crafted link, arbitrary JavaScript will be executed in the admin context. This vulnerability is a moderate‑severity issue associated with CWE‑79.

Affected Systems

The vulnerability affects all instances of the Photo Gallery by 10Web plugin for WordPress whose version is 1.8.34 or earlier. The issue is confined to the image_id parameter used in the plugin’s admin pages; no other WordPress components are impacted.

Risk and Exploitability

The CVSS score of 6.1 indicates a moderate risk, and the EPSS score of less than 1% shows a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because it does not require authentication and targets privileged administrators, a determined attacker can mount a successful XSS attack by sending a malicious link. The overall risk remains moderate, warranting prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

10web

Photo Gallery by 10Web – Mobile-Friendly Image Gallery

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.8.34

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Photo Gallery by 10Web plugin to version 1.8.35 or later, which includes the XSS fix.
Restrict the admin interface behind an additional authentication layer or apply role‑based access control so only trusted users can activate the vulnerable parameter.
Implement input sanitization and output escaping for the image_id parameter, following best practices for mitigating CWE‑79 vulnerabilities.

Generated by OpenCVE AI on April 21, 2026 at 21:21 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-10830	The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.272% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.34/admin/views/Editimage.php#L39
https://www.wordfence.com/threat-intel/vulnerabilities/id/ce261415-870c-4300-85e8-b15a02c7eec5?source=cve

History

Apr 14, 2025 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 11, 2025 11:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Title		Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.34/admin/views/Editimage.php#L39 https://www.wordfence.com/threat-intel/vulnerabilities/id/ce261415-870c-4300-85e8-b15a02c7eec5?source=cve
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`