Photo Gallery by 10Web CVE-2026-12865

Exploitation requires a logged-in WordPress user - contributor or higher for the Shortcode page sink, administrator for the Galleries/Albums sink - to open an attacker-crafted URL while authenticated. The attacker requires no account or authentication on the target site. The Galleries/Albums list page sink renders only when the site has more than 20 galleries or albums, which limits that specific path to active, populated installs but is the typical state of any real-world deployment using the plugin meaningfully. No special server configuration or plugin setting is required beyond the plugin being installed and active. The onfocus auto-firing mechanism reduces (but does not eliminate) the user-interaction requirement: the victim must open the link, but does not need to perform any further click or action.

The CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) is consistent with the vulnerability class. The attacker requires no privileges on the target site, and the onfocus auto-trigger reduces reliance on the victim performing any action beyond opening the URL, partially eroding the protection UI:R is meant to represent. However, social engineering an administrator is still a real barrier - the risk is best characterized as moderate-high for sites with active admin populations exposed to phishing. The Galleries/Albums condition (more than 20 galleries) is not truly limiting since it describes the normal operating state of any populated install; the Shortcode sink has no such threshold. A publicly documented PoC via WPScan means exploitation is trivial for anyone who finds target administrators. EPSS data is absent from the provided intelligence, so a quantitative exploitation-probability estimate is unavailable. The vulnerability is not listed in CISA KEV, so active exploitation is not confirmed. The C:L/I:L/A:L ratings are conservative; in practice a successful session hijack enables full admin compromise of the WordPress site.

An attacker enumerates a WordPress site running Photo Gallery by 10Web before 1.8.44, then constructs a URL to the plugin's Shortcode admin page with a crafted onfocus payload injected into the affected request parameter. The attacker delivers the link to a logged-in contributor via a phishing email; when the contributor's browser opens the page, the onfocus handler fires automatically, exfiltrating the WordPress authentication cookie or nonce to an attacker-controlled server. Because a PoC is publicly available via WPScan, payload construction requires no original research.