CVE-2026-110072 · Package
NO FIX YET · SEE WHAT TO DO
The Photo Gallery by 10Web WordPress plugin does not escape a gallery watermark shortcode attribute before writing it into an HTML image tag, and it decodes percent-encoded characters in that value. A user with Contributor access can store script that runs in the browser of any visitor, including an administrator, who views the published gallery.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Photo Gallery by 10Web WordPress plugin before 1.8.49 where Contributor-level or higher accounts can publish content. Sites without this plugin, or with it already at 1.8.49 or later, are not affected. The sources do not say whether a default configuration is exposed.
Not affected if plugin-not-installed, plugin-updated-1.8.49
Who cares 10web, photo-gallery, wordpress
1.8.49 or later.The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.