CVE-2026-86311: Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

Q: Which users can exploit this issue?

An authenticated user with Author-level access or higher can exploit it. Contributor-level access alone is not supported by the description, despite the title wording.

Q: When does the injected script run?

The script is stored in a page through shortcode attributes and executes whenever another user accesses that injected page.

Q: Which installations are affected?

Affected installations use the Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin at version 1.8.44 or earlier.

Published Sep 17, 2026

Updated

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected Software

1 affected component

WordPress plugin<=1.8.44

Event History

Sep 17, 2026

CVE Published

via MITRE·03:39 AM

Data Sourced

via MITRE·03:39 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

An authenticated user with Author-level access or higher can exploit it. Contributor-level access alone is not supported by the description, despite the title wording.

When does the injected script run?

The script is stored in a page through shortcode attributes and executes whenever another user accesses that injected page.

Which installations are affected?