Vulnerability details
CVE-2026-12865
Photo Gallery by 10Web
Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters
CVSS 3.1
7.1High
Official description
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| — | Photo Gallery by 10Web | v < 1.8.44 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://wpscan.com/vulnerability/a78cc4ca-120e-4b6e-9285-34dcaa0bca77/ exploitvdb-entrytechnical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-02
- Last updated
- 2026-09-02
- State
- Published
- Assigner (CNA)
- WPScan
Exploit prediction (EPSS)
0.28%
Probability of exploitation in 30 days
20.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')