CVE-2026-12865: Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Photo Gallery by 10Webto a version that resolves this vulnerability.Fixed in 1.8.44 - Compensating control
Ensure only trusted users can access the Photo Gallery by 10Web plugin admin pages (Shortcode page and Galleries/Albums list page) where reflected parameters are rendered, until all sites are upgraded to 1.8.44.
Event History
Frequently Asked Questions
Who can be targeted by each vulnerable admin page?
The Shortcode-page sink can execute JavaScript when a logged-in contributor or administrator opens a crafted link. The Galleries/Albums list-page sink requires the victim to be a logged-in administrator.
Are all installations exposed to the Galleries/Albums issue?
No. The Galleries/Albums sink is rendered only when the site has more than 20 galleries or albums, which is described as the normal state for a populated installation.
What does an attacker need to exploit this issue?
An attacker does not need to be authenticated, but must craft a malicious link and persuade an eligible logged-in victim to open it. The payload executes in the victim's authenticated browser session through an auto-firing onfocus handler.
Which plugin versions are affected?
Versions of Photo Gallery by 10Web before 1.8.44 are affected.