EUVD-2026-69870
GHSA-487r-gpmr-7hw3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered reflected XSS with no attacker privileges and user-interaction required; no meaningful availability impact from XSS alone, so A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).
AnalysisAI
Reflected XSS in Photo Gallery by 10Web WordPress plugin (all versions before 1.8.44) lets an unauthenticated attacker execute arbitrary JavaScript inside the authenticated browser session of an administrator or contributor by tricking them into clicking a crafted link. Two distinct injection sinks exist: the Shortcode admin page (exploitable against contributors and above) and the Galleries/Albums list page (requires the site to have more than 20 galleries, and targets administrators). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a logged-in WordPress user - contributor or higher for the Shortcode page sink, administrator for the Galleries/Albums sink - to open an attacker-crafted URL while authenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) is consistent with the vulnerability class. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Photo Gallery by 10Web to version 1.8.44 or later via the WordPress plugin repository or the 10Web dashboard; this is the only confirmed fix per EUVD-2026-69870 and WPScan. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your installations for Photo Gallery by 10Web and identify all users with administrator or contributor roles, as they are the primary social engineering targets; immediately communicate the vulnerability risk to these users and direct them not to click unfamiliar links pointing to the site's dashboard. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Photo Gallery By 10web
View allBlind SQL injection in the Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.41) allows high-pri
Photo Gallery by 10Web versions up to 1.8.37 contain a cross-site request forgery vulnerability that enables unauthentic
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today