CVE-2026-42715: WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability

Q: Does an attacker need an account on the WordPress site to exploit this issue?

No. The vulnerability is described as unauthenticated, so an attacker does not need to authenticate before attempting exploitation.

Q: Which plugin versions are affected?

Photo Gallery by 10Web versions 1.8.47 and earlier are identified as affected.

Q: Is user interaction required for exploitation?

Yes. The vector indicates user interaction is required, meaning exploitation depends on a user interacting with attacker-controlled content or a crafted request.

Published Oct 10, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

Affected Software

1 affected component

10web Photo Gallery by 10Web<=1.8.47

Event History

Oct 10, 2026

CVE Published

via MITRE·07:35 PM

Data Sourced

via MITRE·07:35 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need an account on the WordPress site to exploit this issue?

No. The vulnerability is described as unauthenticated, so an attacker does not need to authenticate before attempting exploitation.

Which plugin versions are affected?

Photo Gallery by 10Web versions 1.8.47 and earlier are identified as affected.

Is user interaction required for exploitation?