The Photo Gallery by 10Web – Mobile‑Friendly Image Gallery plugin stores shortcode attribute values in the database without sanitization, allowing authenticated authors or higher roles to inject persistent JavaScript. An attacker can embed malicious code that executes whenever a page using the gallery shortcode is accessed, potentially leading to session hijacking, credential theft, or defacement. This flaw is a classic input validation failure, identified as CWE‑79.

All WordPress installations running Photo Gallery by 10Web – Mobile‑Friendly Image Gallery version 1.8.44 or earlier are affected. The vulnerability applies to the 10web product across all WordPress environments that use these plugin versions.

The CVSS score of 6.4 classifies this flaw as medium severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack requires only a contributor or higher role, which most content managers possess, meaning an authorized user can inject scripts that persistently affect all visitors to a gallery page. Should an attacker gain sufficient privileges or compromise a user account, the injected payload becomes immediately active for any page visitor.