---
id: "CVE-2026-110072"
page: "https://infrastack.ai/live/CVE-2026-110072"
kind: "vulnerability"
aliases: ["CVE-2026-110072"]
title: "WordPress Photo Gallery plugin: shortcode attribute enables stored cross-site scripting"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["10web", "package", "photo-gallery", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-updated-1.8.49"]
published_at: "2026-11-12T06:17:10+00:00"
first_seen_at: "2026-11-12T06:36:51+00:00"
updated_at: "2026-11-12T06:38:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110072", "first_seen_at": "2026-11-12T06:36:51+00:00"}]
exploit_sources: []
---

# WordPress Photo Gallery plugin: shortcode attribute enables stored cross-site scripting

Link for people: https://infrastack.ai/live/CVE-2026-110072 (this .md is for agents)

The Photo Gallery by 10Web WordPress plugin does not escape a gallery watermark shortcode attribute before writing it into an HTML image tag, and it decodes percent-encoded characters in that value. A user with Contributor access can store script that runs in the browser of any visitor, including an administrator, who views the published gallery.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Photo Gallery by 10Web plugin in the WordPress admin under Plugins; unknown whether the sources name a specific install path.
- Search published posts and pages for the gallery shortcode with a watermark attribute, which the sources do not name exactly, so unknown.

## Fix

- The Photo Gallery by 10Web plugin: update to version `1.8.49` or later.

## Timeline

- 2026-11-12T06:36:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110072

## From the sources

The Photo Gallery by 10Web  WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_