Description
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Published: 2026-10-15
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The Photo Gallery by 10Web plugin has a reflected XSS vulnerability in the 'title' parameter, allowing unauthenticated attackers to inject arbitrary JavaScript into rendered pages. If a victim clicks a crafted link, the malicious code executes in their browser, potentially enabling cookie theft, defacement, or other client‑side attacks. This flaw arises from missing input validation and output escaping.

Affected Systems

WordPress installations running the Photo Gallery by 10Web – Mobile‑Friendly Image Gallery plugin, versions up to and including 1.8.42.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity. The EPSS score is not available, but the vulnerability is publicly known and could be leveraged by attackers who can entice users with a malicious URL. Since it is not listed in the CISA KEV catalog, no current known exploitation activity is recorded, yet the reflection nature of the flaw means that exploitation is straightforward for anyone who can attract victim interaction.

Generated by OpenCVE AI on October 15, 2026 at 11:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Photo Gallery by 10Web plugin to version 1.8.43 or later.
  • If an upgrade is not possible immediately, implement a web‑application firewall rule that removes or blocks malicious content from the 'title' parameter.
  • Review other input parameters in the plugin to ensure they are properly sanitized and escaped.

Generated by OpenCVE AI on October 15, 2026 at 11:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared 10web
10web photo Gallery By 10web – Mobile-friendly Image Gallery
Wordpress-extensions
Wordpress-extensions photo Gallery By 10web
Vendors & Products 10web
10web photo Gallery By 10web – Mobile-friendly Image Gallery
Wordpress-extensions
Wordpress-extensions photo Gallery By 10web

Thu, 15 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Description The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

10web Photo Gallery By 10web – Mobile-friendly Image Gallery
Wordpress-extensions Photo Gallery By 10web
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-15T16:43:40.915Z

Reserved: 2026-08-01T14:06:57.066Z

Link: CVE-2026-18557

cve-icon Vulnrichment

Updated: 2026-10-15T16:38:04.990Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T06:17:03.200

Modified: 2026-10-15T17:17:21.333

Link: CVE-2026-18557

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T12:30:11Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')