Live › vulnerability › CVE-2026-118081
The 10Web Social Photo Feed WordPress plugin, versions 1.5.6 and earlier, has a PHP object injection flaw that a contributor-level user can trigger. Successful exploitation can let an attacker run code or manipulate data on the site, depending on available gadget classes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the 10Web Social Photo Feed WordPress plugin at version 1.5.6 or earlier where users with Contributor access exist. Sites without the plugin, or with it updated past 1.5.6, are not affected per the description.
No product ranges from the sources yet.
1.5.6; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118081")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.