Description
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).
Published: 2026-09-02
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Reflected XSS allowing arbitrary JavaScript execution in authenticated admin sessions.
Action: Immediate Patch
AI Analysis

Impact

The Photo Gallery by 10Web WordPress plugin before version 1.8.44 fails to escape two request parameters before reflecting them into input-attribute values on its admin pages. An unauthenticated attacker can craft a link that, when opened by a logged‑in administrator (or a contributor for the Shortcode sink), triggers an auto-firing onfocus handler that executes attacker‑supplied JavaScript within the victim’s authenticated session.

Affected Systems

WordPress installations running Photo Gallery by 10Web plugin version earlier than 1.8.44. The vulnerability is present on the plugin’s admin “Shortcode” page and, for sites with more than 20 galleries/albums, on the “Galleries/Albums” list page.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user to open a crafted link; no authentication is required for the attacker to send the request. Based on the description, the likely attack vector is through email, social media, or embedded links, making the risk significant for sites that use this plugin.

Generated by OpenCVE AI on September 2, 2026 at 14:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Photo Gallery by 10Web to version 1.8.44 or later.
  • If the upgrade cannot be performed immediately, disable the plugin or restrict administrative access to the Shortcode and Galleries/Albums pages until the patch is applied.
  • Deploy a web application firewall or a content security policy that blocks or sanitizes inputs on the vulnerable admin pages to mitigate exploitation until the patch is applied.

Generated by OpenCVE AI on September 2, 2026 at 14:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79

Wed, 02 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).
Title Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-02T10:45:59.458Z

Reserved: 2026-06-22T08:21:36.492Z

Link: CVE-2026-12865

cve-icon Vulnrichment

Updated: 2026-09-02T10:13:29.337Z

cve-icon NVD

Status : Deferred

Published: 2026-09-02T06:17:15.917

Modified: 2026-09-03T17:49:19.180

Link: CVE-2026-12865

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T14:15:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')