{"id":"CVE-2026-110072","kind":"vulnerability","aliases":["CVE-2026-110072"],"related":[],"title":"WordPress Photo Gallery plugin: shortcode attribute enables stored cross-site scripting","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.","summary":"The Photo Gallery by 10Web WordPress plugin does not escape a gallery watermark shortcode attribute before writing it into an HTML image tag, and it decodes percent-encoded characters in that value. A user with Contributor access can store script that runs in the browser of any visitor, including an administrator, who views the published gallery.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["10web","package","photo-gallery","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated-1.8.49"],"how_to_check":"- Check the installed version of the Photo Gallery by 10Web plugin in the WordPress admin under Plugins; unknown whether the sources name a specific install path.\n- Search published posts and pages for the gallery shortcode with a watermark attribute, which the sources do not name exactly, so unknown.","fix":"- The Photo Gallery by 10Web plugin: update to version `1.8.49` or later.","status":"open","published_at":"2026-11-12T06:17:10+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","triaged_at":"2026-11-12T06:38:06+00:00","updated_at":"2026-11-12T06:38:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T06:38:06Z","model":"claude-haiku-5-5","output":{"fix":"- The Photo Gallery by 10Web plugin: update to version `1.8.49` or later.","reach":"internet","title":"WordPress Photo Gallery plugin: shortcode attribute enables stored cross-site scripting","impact":"medium","summary":"The Photo Gallery by 10Web WordPress plugin does not escape a gallery watermark shortcode attribute before writing it into an HTML image tag, and it decodes percent-encoded characters in that value. A user with Contributor access can store script that runs in the browser of any visitor, including an administrator, who views the published gallery.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","photo-gallery","10web"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in administrators' browsers, enabling account takeover","analyst_note":"","how_to_check":"- Check the installed version of the Photo Gallery by 10Web plugin in the WordPress admin under Plugins; unknown whether the sources name a specific install path.\n- Search published posts and pages for the gallery shortcode with a watermark attribute, which the sources do not name exactly, so unknown.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-updated-1.8.49","plugin-not-installed"],"who_is_affected":"Sites running the Photo Gallery by 10Web WordPress plugin before 1.8.49 where Contributor-level or higher accounts can publish content. Sites without this plugin, or with it already at 1.8.49 or later, are not affected. The sources do not say whether a default configuration is exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4594,"output_tokens":605,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110072':15A,18A '-2026':14A,17A '1.8.49':90C '10web':19B,29B,86C 'access':62B,126C 'administr':76B,146C 'allow':120C 'attribut':6A,39B,96C,110C 'browser':70B,140C 'charact':54B,116C 'contributor':61B,124C 'contributor-level':123C 'cross':10A,133C 'cross-sit':9A,132C 'cve':13A,16A 'decod':50B,112C 'enabl':7A 'encod':53B,115C 'escap':34B,93C 'execut':137C 'galleri':3A,23B,27B,36B,81B,84C,100C,151C 'html':45B,108C 'imag':46B,102C,109C 'includ':74B,144C 'level':125C 'packag':20B 'percent':52B,114C 'percent-encod':51B,113C 'perform':130C 'photo':2A,22B,26B,83C 'photo-galleri':21B 'plugin':4A,31B,88C 'publish':80B,150C 'render':104C 'run':67B 'script':12A,65B,135C 'set':98C 'shortcod':5A,38B,95C 'site':11A,134C 'store':8A,64B,131C 'tag':47B 'user':59B,121C,143C 'valu':57B,119C 'view':78B,148C 'visitor':73B 'watermark':37B,101C 'wordpress':1A,24B,30B,87C 'write':41B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Photo Gallery by 10Web WordPress plugin before 1.8.49 where Contributor-level or higher accounts can publish content. Sites without this plugin, or with it already at 1.8.49 or later, are not affected. The sources do not say whether a default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["10web","medium","package","photogallery","wordpress"],"campaign_type":null,"search_a":"'-110072':15A,18A '-2026':14A,17A 'attribut':6A 'cross':10A 'cross-sit':9A 'cve':13A,16A 'enabl':7A 'galleri':3A 'photo':2A 'plugin':4A 'script':12A 'shortcod':5A 'site':11A 'store':8A 'wordpress':1A","search_b":"'10web':19B,29B 'access':62B 'administr':76B 'attribut':39B 'browser':70B 'charact':54B 'contributor':61B 'decod':50B 'encod':53B 'escap':34B 'galleri':23B,27B,36B,81B 'html':45B 'imag':46B 'includ':74B 'packag':20B 'percent':52B 'percent-encod':51B 'photo':22B,26B 'photo-galleri':21B 'plugin':31B 'publish':80B 'run':67B 'script':65B 'shortcod':38B 'store':64B 'tag':47B 'user':59B 'valu':57B 'view':78B 'visitor':73B 'watermark':37B 'wordpress':24B,30B 'write':41B","search_c":"'1.8.49':90C '10web':86C 'access':126C 'administr':146C 'allow':120C 'attribut':96C,110C 'browser':140C 'charact':116C 'contributor':124C 'contributor-level':123C 'cross':133C 'cross-sit':132C 'decod':112C 'encod':115C 'escap':93C 'execut':137C 'galleri':84C,100C,151C 'html':108C 'imag':102C,109C 'includ':144C 'level':125C 'percent':114C 'percent-encod':113C 'perform':130C 'photo':83C 'plugin':88C 'publish':150C 'render':104C 'script':135C 'set':98C 'shortcod':95C 'site':134C 'store':131C 'user':121C,143C 'valu':119C 'view':148C 'watermark':101C 'wordpress':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110072","severity":null,"published_at":"2026-11-12T06:17:10+00:00","modified_at":"2026-11-12T06:17:10+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","fetched_at":"2026-11-12T06:36:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}