7.1

CVE-2026-12865

Exploit

Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters

Photo Gallery by 10Web – Mobile-Friendly Image Gallery < 1.8.44 - Reflected Cross-Site Scripting

The Photo Gallery by 10Web  WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).
Mögliche Gegenmaßnahme
Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Update to version 1.8.44, or a newer patched version
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerUnknown
≫
Produkt Photo Gallery by 10Web
Default Statusunaffected
Version 0
Version < 1.8.44
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Version [*, 1.8.44)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.101
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 7.1 2.8 3.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://wpscan.com/vulnerability/a78cc4ca-120e-4b6e-9285-34dcaa0bca77/
https://www.wordfence.com/threat-intel/vulnerabilities/id/d1ff2dee-1fa6-4093-9c96-f573f4fa2ba9
Third Party Advisory