Description
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Published: 2025-04-11
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting (XSS)
Action: Patch Immediately
AI Analysis

Impact

The Photo Gallery by 10Web – Mobile‑Friendly Image Gallery plugin for WordPress is vulnerable to Reflected XSS through the image_id parameter because the input is not sanitized and the output is not escaped. When an attacker can entice an administrative user to click a crafted link, arbitrary JavaScript will be executed in the admin context. This vulnerability is a moderate‑severity issue associated with CWE‑79.

Affected Systems

The vulnerability affects all instances of the Photo Gallery by 10Web plugin for WordPress whose version is 1.8.34 or earlier. The issue is confined to the image_id parameter used in the plugin’s admin pages; no other WordPress components are impacted.

Risk and Exploitability

The CVSS score of 6.1 indicates a moderate risk, and the EPSS score of less than 1% shows a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because it does not require authentication and targets privileged administrators, a determined attacker can mount a successful XSS attack by sending a malicious link. The overall risk remains moderate, warranting prompt remediation.

Generated by OpenCVE AI on April 21, 2026 at 21:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Photo Gallery by 10Web plugin to version 1.8.35 or later, which includes the XSS fix.
  • Restrict the admin interface behind an additional authentication layer or apply role‑based access control so only trusted users can activate the vulnerable parameter.
  • Implement input sanitization and output escaping for the image_id parameter, following best practices for mitigating CWE‑79 vulnerabilities.

Generated by OpenCVE AI on April 21, 2026 at 21:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-10830 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
History

Mon, 14 Apr 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 11 Apr 2025 23:30:00 +0000

Type Values Removed Values Added
Description The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Title Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:24:21.021Z

Reserved: 2025-03-12T20:52:26.055Z

Link: CVE-2025-2269

cve-icon Vulnrichment

Updated: 2025-04-14T16:56:26.244Z

cve-icon NVD

Status : Deferred

Published: 2025-04-12T00:15:18.367

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-2269

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T21:30:45Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')