The vulnerability in the Photo Gallery by 10Web WordPress plugin allows an unauthenticated attacker to craft a link that, when opened by a logged‑in administrator (or a contributor for the first sink), causes the browser to execute arbitrary JavaScript. The attacker achieves this by injecting script into request parameters that are echoed unescaped into HTML attribute values on admin pages, triggering an `onfocus` handler that runs the payload. This directly compromises confidentiality, integrity, and availability of the administrator’s session, potentially allowing credential theft, session hijacking, or defacement of the site.

WordPress sites running the Photo Gallery by 10Web plugin with a version earlier than 1.8.44. The plugin’s admin “Shortcode” and “Galleries/Albums” pages use the vulnerable parameters; the latter only appears when the site has more than 20 galleries/albums, a common condition for populated installations.

The vulnerability is a classic reflected XSS with no authentication requirement to exploit, but it requires the target to open the crafted link while authenticated. No CVSS or EPSS score is published, and the issue is not listed in CISA’s KEV catalog. Despite the lack of public exploitation metrics, the practical impact is high: any administrator who clicks a malicious link could have their session hijacked or the site compromised. The attack surface is portable via email, social media, or embedded links, making it a significant risk for sites that rely on this plugin.