Photo Gallery by 10Web vulnerabilities
3 known CVE vulnerabilities in Photo Gallery by 10Web, translated and rated.
- CVE-2026-12865High
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page). An unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums.
- CVE-2026-9829Medium
The Photo Gallery by 10Web plugin for WordPress up to version 1.8.41 is vulnerable to time-based SQL Injection via the 'compact_album_order_by' shortcode parameter. Authenticated attackers with contributor-level access can inject additional SQL queries and trigger them unauthenticated via another AJAX handler.
- CVE-2026-49771High
The Photo Gallery by 10Web plugin for WordPress versions up to 1.8.41 is vulnerable to blind SQL injection. Attackers can inject SQL queries through unsanitized input.