CVE-2026-110072: Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attribute

Q: Who can exploit this issue, and who is at risk from the payload?

A user with Contributor-level access or higher can create the stored payload. It executes in the browser of any user who views the published gallery, including an administrator.

Q: What input is used to deliver the XSS payload?

The vulnerable input is the shortcode attribute that sets a gallery watermark image. Percent-encoded characters in that attribute are decoded before the value is rendered into an HTML image attribute.

Q: Which plugin versions are affected?

Photo Gallery by 10Web versions before 1.8.49 are affected. Updating to version 1.8.49 or later addresses the described vulnerable behavior.

Published Nov 12, 2026

Updated

The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the payload?

A user with Contributor-level access or higher can create the stored payload. It executes in the browser of any user who views the published gallery, including an administrator.

What input is used to deliver the XSS payload?

The vulnerable input is the shortcode attribute that sets a gallery watermark image. Percent-encoded characters in that attribute are decoded before the value is rendered into an HTML image attribute.

Which plugin versions are affected?

Photo Gallery by 10Web versions before 1.8.49 are affected. Updating to version 1.8.49 or later addresses the described vulnerable behavior.

CVE-2026-110072: Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attribute

Event History

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the payload?

What input is used to deliver the XSS payload?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the payload?

What input is used to deliver the XSS payload?

Which plugin versions are affected?