Photo Gallery by 10Web EUVD-2026-101844

Exploitation requires the attacker to craft a request where the 'title' parameter carries a script payload that the plugin reflects back without sanitization or output escaping, affecting all versions of Photo Gallery by 10Web through 1.8.42. No authentication is required (PR:N), but exploitation is strictly gated on user interaction (UI:R): a victim - ideally a logged-in administrator - must be tricked into clicking the attacker-crafted link, and because the flaw is reflected (not stored) there is no persistence, so each victim must be individually lured. Realistic risk is thus limited to sites that receive untrusted traffic and users susceptible to phishing; fully patched sites (1.8.43+) are not affected.

This is a moderate, not top-tier, priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1 MEDIUM) describes a reflected XSS that is network-reachable and unauthenticated (PR:N) but gated on user interaction (UI:R), which is the dominant limiting factor - the attacker cannot act autonomously and must socially engineer a victim into clicking a crafted link. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit (POC) is referenced, so there is no public exploit identified at time of analysis; the only reporter is Wordfence (a credible WordPress-security vendor) with a patch committed upstream. The scope change (S:C) and C:L/I:L reflect that injected script executes in the victim's browser context rather than compromising the server directly - typical of reflected XSS, where impact is session/credential theft or forced actions, not host takeover. The signals are internally consistent (no conflict between vector and description): network vector with mandatory user interaction and limited, browser-scoped impact. Bottom line - real but low-urgency; patch during normal cycles rather than emergency response, with priority raised for sites exposed to untrusted/public visitors.

An attacker crafts a URL for a vulnerable site that places a malicious script in the 'title' parameter and distributes it via phishing email, forum post, or social media. When a logged-in administrator or site visitor clicks the link, the unsanitized value is reflected into the page and the script executes in their browser, enabling session/cookie theft or actions performed as the victim. No public exploit code is identified, but the single-parameter reflected nature makes a working payload trivial to construct.