10Web Photo Gallery EUVD-2026-81316

Requires an authenticated WordPress account with Author-level capabilities or higher on a site running Photo Gallery by 10Web version 1.8.44 or earlier, with the plugin's shortcode functionality in use. The attacker injects the payload through Shortcode Attributes; the stored script only fires when a user subsequently loads the affected page, so impact depends on a victim (ideally a higher-privileged admin/editor) viewing the injected content. Exploitation is limited by the Author-level trust requirement - anonymous or Subscriber-level users cannot exploit it - but no additional non-default configuration is needed beyond normal plugin use.

This is a genuine but moderate-priority issue, not a critical one. The vendor CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) is driven largely by the scope change (S:C), which is standard for stored XSS in a web app where injected script executes in another user's browser context. The real limiting factor is PR:L: exploitation requires an authenticated account with Author-level access or above, which is a meaningful trust barrier - this is not an anonymous-internet-facing flaw. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or automated exploitation. SSVC framework data was not provided. Overall this is a typical authenticated stored-XSS in a widely deployed plugin: worth patching promptly given the plugin's large install base, but the Author-level prerequisite and lack of exploitation signals place it below unauthenticated RCE-class emergencies. Confidentiality and integrity impacts are rated Low (C:L/I:L) and availability is None (A:N), consistent with script injection rather than data destruction.

An attacker who has obtained (or been granted) an Author-level WordPress account crafts a Photo Gallery shortcode with a malicious attribute value that is stored without sufficient sanitization. When any user - including a higher-privileged administrator - views the page containing that shortcode, the injected JavaScript executes in their session, enabling session/cookie theft or actions on their behalf. No public exploit code is identified in the provided data.