CVE-2026-18557: Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Photo Gallery by 10Web for WordPress is affected in all versions through 1.8.42, inclusive. The referenced plugin changeset compares version 1.8.42 with 1.8.43.
Does exploitation require an authenticated WordPress account?
No. An unauthenticated attacker can attempt to exploit the issue, but must persuade a user to perform an action such as clicking a crafted link containing the malicious title parameter.
What could happen if a user triggers a malicious link?
Attacker-supplied script can execute in the affected page context. The reported impact includes low confidentiality and integrity impact, with no reported availability impact.