10Web Photo Gallery CVE-2026-42715

Exploitation requires victim user interaction (CVSS UI:R) - the attacker cannot trigger the payload autonomously and must get a user to load or click attacker-controlled content processed by the Photo Gallery by 10Web plugin. No authentication is required of the attacker (PR:N, 'Unauthenticated' per description), so any remote party can craft the payload. The main limiting factors are: (1) the mandatory user-interaction step; (2) the target site must run Photo Gallery by 10Web version 1.8.47 or earlier; and (3) impact severity depends on the privilege of the victim whose browser executes the script (an administrator victim yields the highest impact). The provided description does not name the specific vulnerable parameter, input field, or whether a non-default plugin configuration is needed.

This is a CWE-79 Cross-Site Scripting flaw in the 10Web Photo Gallery WordPress plugin (<= 1.8.47), rated CVSS 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The signals are moderate and internally consistent: network vector and no privileges required (PR:N, confirming unauthenticated reach per the description's 'Unauthenticated' label) are offset by the mandatory user interaction (UI:R) - a victim must load attacker-influenced content for the payload to fire, which limits mass drive-by exploitation. The scope change (S:C) reflects that injected script executes in the victim's browser context outside the vulnerable component, the standard justification for XSS scope changes. No EPSS score, CISA KEV entry, or POC indicator was supplied in the intelligence, so this is not demonstrably a weaponized or actively exploited issue - exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a credible but not emergency priority. It is a real, patchable XSS in a popular plugin that warrants routine-to-prompt patching, not the drop-everything urgency reserved for KEV-listed or auto-exploitable flaws. The absence of EPSS/KEV data means widespread automated exploitation cannot be confirmed or ruled out from the provided inputs.

An unauthenticated attacker crafts a malicious link or input containing a JavaScript payload targeting the Photo Gallery plugin and lures a victim (potentially a logged-in administrator) into visiting it. When the victim's browser renders the unsanitized content, the script executes in their session context, enabling session/cookie theft, admin-action forgery, or defacement. No public proof-of-concept was identified in the provided data, and successful exploitation depends on the victim interacting with the attacker-supplied content (UI:R).