Vulnerabilities and security researches forphoto-gallery photo-gallery
Direction: ascendingJun 06, 2024
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2021-24363
- CVE, Research URL
- Date
- Aug 16, 2021
- Research Description
- The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2021-24139
- CVE, Research URL
- Date
- Mar 18, 2021
- Research Description
- Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2021-24291
- CVE, Research URL
- Date
- May 14, 2021
- Research Description
- The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2021-24362
- CVE, Research URL
- Date
- Aug 16, 2021
- Research Description
- The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly (ie in the /wp-content/uploads/photo-gallery/ folder), leading to a Cross-Site Scripting (XSS) issue
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2021-24310
- CVE, Research URL
- Date
- Jun 01, 2021
- Research Description
- The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2020-9335
- CVE, Research URL
- Date
- Feb 25, 2020
- Research Description
- Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2022-0169
- CVE, Research URL
- Date
- Mar 14, 2022
- Research Description
- The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2019-16119
- CVE, Research URL
- Date
- Sep 09, 2019
- Research Description
- SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2021-25041
- CVE, Research URL
- Date
- Dec 06, 2021
- Research Description
- The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2019-16117
- CVE, Research URL
- Date
- Sep 09, 2019
- Research Description
- Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2019-16118
- CVE, Research URL
- Date
- Sep 09, 2019
- Research Description
- Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2015-9380
- CVE, Research URL
- Date
- Aug 30, 2019
- Research Description
- The photo-gallery plugin before 1.2.42 for WordPress has CSRF.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2015-1394
- CVE, Research URL
- Date
- Feb 08, 2020
- Research Description
- Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2017-12977
- CVE, Research URL
- Date
- Aug 21, 2017
- Research Description
- The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators via the tag_id parameter.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2022-1281
- CVE, Research URL
- Date
- May 02, 2022
- Research Description
- The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2019-14313
- CVE, Research URL
- Date
- Jul 30, 2019
- Research Description
- A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2015-2324
- CVE, Research URL
- Date
- Feb 20, 2018
- Research Description
- Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2014-6315
- CVE, Research URL
- Date
- Oct 10, 2014
- Research Description
- Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) callback, (2) dir, or (3) extensions parameter in an addImages action to wp-admin/admin-ajax.php.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2022-1282
- CVE, Research URL
- Date
- May 02, 2022
- Research Description
- The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2019-14797
- CVE, Research URL
- Date
- Aug 09, 2019
- Research Description
- The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2019-14798
- CVE, Research URL
- Date
- Aug 09, 2019
- Research Description
- The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2015-1393
- CVE, Research URL
- Date
- Feb 02, 2015
- Research Description
- SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2015-1055
- CVE, Research URL
- Date
- Jan 16, 2015
- Research Description
- SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2022-4058
- CVE, Research URL
- Date
- Dec 19, 2022
- Research Description
- The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2022-1394
- CVE, Research URL
- Date
- Jun 08, 2022
- Research Description
- The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2014-9312
- CVE, Research URL
- Date
- Aug 28, 2017
- Research Description
- Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2021-46889
- CVE, Research URL
- Date
- Jun 07, 2023
- Research Description
- The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2021-31693
- CVE, Research URL
- Date
- Nov 30, 2022
- Research Description
- The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-46889. NOTE: VMware information, previously connected to this CVE ID because of a typo, is at CVE-2022-31693.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2023-6924
- CVE, Research URL
- Date
- Jan 11, 2024
- Research Description
- The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. It can also be exploited with a contributor-level permission with a page builder plugin.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-29832
- CVE, Research URL
- Date
- Mar 26, 2024
- Research Description
- The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-29833
- CVE, Research URL
- Date
- Mar 26, 2024
- Research Description
- The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-0221
- CVE, Research URL
- Date
- Feb 06, 2024
- Research Description
- The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead to site takeovers if the wp-config.php file of a site can be renamed. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery management permissions to lower level users, which might make this exploitable by users as low as contributors.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-29808
- CVE, Research URL
- Date
- Mar 26, 2024
- Research Description
- The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-2296
- CVE, Research URL
- Date
- Apr 06, 2024
- Research Description
- The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.8.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-33586
- CVE, Research URL
- Date
- Apr 29, 2024
- Research Description
- Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.20.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-29809
- CVE, Research URL
- Date
- Mar 26, 2024
- Research Description
- The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-29810
- CVE, Research URL
- Date
- Mar 26, 2024
- Research Description
- The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-32583
- CVE, Research URL
- Date
- Apr 18, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Reflected XSS.This issue affects Photo Gallery by 10Web: from n/a through 1.8.21.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-35628
- CVE, Research URL
- Date
- Jun 11, 2024
- Research Description
- Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.25.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Jun 08, 2024
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-5481
- CVE, Research URL
- Date
- Jun 07, 2024
- Research Description
- The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the esc_dir function. This makes it possible for authenticated attackers to cut and paste (copy) the contents of arbitrary files on the server, which can contain sensitive information, and to cut (delete) arbitrary directories, including the root WordPress directory. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery edit permissions to lower level users, which might make this exploitable by users as low as contributors.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-5426
- CVE, Research URL
- Date
- Jun 07, 2024
- Research Description
- The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure Photo Gallery can be extended to contributors on pro versions of the plugin.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Jun 10, 2024
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2023-33995
- CVE, Research URL
- Date
- Dec 13, 2024
- Research Description
- Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Sep 27, 2024
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-44043
- CVE, Research URL
- Date
- Oct 06, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through 1.8.27.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Oct 10, 2024
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-5968
- CVE, Research URL
- Date
- Oct 09, 2024
- Research Description
- The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Nov 03, 2024
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-8670
- CVE, Research URL
- Date
- -
- Research Description
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery] < 1.8.29 CVE-2024-8670
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Nov 05, 2024
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-9878
- CVE, Research URL
- Date
- Nov 05, 2024
- Research Description
- The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Dec 03, 2024
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-10704
- CVE, Research URL
- Date
- Nov 29, 2024
- Research Description
- The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Mar 26, 2025
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2024-13124
- CVE, Research URL
- Date
- Mar 24, 2025
- Research Description
- The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Apr 13, 2025
Photo Gallery by 10Web – Mobile-Friendly Image Gallery # CVE-2025-2269
- CVE, Research URL
- Date
- Apr 12, 2025
- Research Description
- The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable