Photo Gallery By 10web
Monthly
Unauthenticated cross-site scripting in the 10Web Photo Gallery plugin for WordPress affects every version up to and including 1.8.47, allowing any remote party to deliver script that executes in the browser of a site user who interacts with the attacker-controlled content. Rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no authentication on the attacker's side, so the only real barriers are the mandatory victim interaction and the requirement that the target site run the vulnerable plugin version - impact scales with the privilege of the victim, and an administrator victim yields the highest payoff since the injected script would run with that user's session privileges. No public exploit code and no CISA KEV entry were identified at the time of analysis; the sole reference is the Patchstack advisory, which does not name the vulnerable parameter/input field or state whether a non-default plugin configuration is required.
PHP object injection in the Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.46) allows an authenticated user with Contributor-level privileges to pass crafted serialized data into a plugin code path that calls unserialize(), which under CVSS 3.1 scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation can corrupt or disclose data and, if a usable PHP gadget chain exists in the plugin, WordPress core, or another active plugin, can escalate to arbitrary code execution on the web server; no user interaction is required once the low-privileged account exists. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and authentication as Contributor or higher is a firm prerequisite, so exposure is concentrated on sites that grant Contributor+ roles to untrusted users or leave open registration enabled.
Reflected XSS in Photo Gallery by 10Web WordPress plugin (all versions before 1.8.44) lets an unauthenticated attacker execute arbitrary JavaScript inside the authenticated browser session of an administrator or contributor by tricking them into clicking a crafted link. Two distinct injection sinks exist: the Shortcode admin page (exploitable against contributors and above) and the Galleries/Albums list page (requires the site to have more than 20 galleries, and targets administrators). Both sinks reflect unsanitized request parameters into HTML input-attribute values and weaponize an auto-firing onfocus event handler, bypassing some user-interaction defenses. A publicly available PoC via WPScan confirms the issue; vendor-patched version 1.8.44 is available.
Blind SQL injection in the Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.41) allows high-privileged authenticated users to inject crafted SQL fragments into a vulnerable query, exfiltrate database contents, and affect availability. CVSS 7.6 (Scope:Changed) reflects the cross-component impact possible from a successful injection within the WordPress database context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Photo Gallery by 10Web versions up to 1.8.37 contain a cross-site request forgery vulnerability that enables unauthenticated attackers to perform unauthorized actions on behalf of authenticated users through crafted requests. The vulnerability requires user interaction and allows attackers to modify or delete gallery content with no direct access needed. No patch is currently available for this vulnerability.
Unauthenticated cross-site scripting in the 10Web Photo Gallery plugin for WordPress affects every version up to and including 1.8.47, allowing any remote party to deliver script that executes in the browser of a site user who interacts with the attacker-controlled content. Rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no authentication on the attacker's side, so the only real barriers are the mandatory victim interaction and the requirement that the target site run the vulnerable plugin version - impact scales with the privilege of the victim, and an administrator victim yields the highest payoff since the injected script would run with that user's session privileges. No public exploit code and no CISA KEV entry were identified at the time of analysis; the sole reference is the Patchstack advisory, which does not name the vulnerable parameter/input field or state whether a non-default plugin configuration is required.
PHP object injection in the Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.46) allows an authenticated user with Contributor-level privileges to pass crafted serialized data into a plugin code path that calls unserialize(), which under CVSS 3.1 scores 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation can corrupt or disclose data and, if a usable PHP gadget chain exists in the plugin, WordPress core, or another active plugin, can escalate to arbitrary code execution on the web server; no user interaction is required once the low-privileged account exists. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and authentication as Contributor or higher is a firm prerequisite, so exposure is concentrated on sites that grant Contributor+ roles to untrusted users or leave open registration enabled.
Reflected XSS in Photo Gallery by 10Web WordPress plugin (all versions before 1.8.44) lets an unauthenticated attacker execute arbitrary JavaScript inside the authenticated browser session of an administrator or contributor by tricking them into clicking a crafted link. Two distinct injection sinks exist: the Shortcode admin page (exploitable against contributors and above) and the Galleries/Albums list page (requires the site to have more than 20 galleries, and targets administrators). Both sinks reflect unsanitized request parameters into HTML input-attribute values and weaponize an auto-firing onfocus event handler, bypassing some user-interaction defenses. A publicly available PoC via WPScan confirms the issue; vendor-patched version 1.8.44 is available.
Blind SQL injection in the Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.41) allows high-privileged authenticated users to inject crafted SQL fragments into a vulnerable query, exfiltrate database contents, and affect availability. CVSS 7.6 (Scope:Changed) reflects the cross-component impact possible from a successful injection within the WordPress database context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Photo Gallery by 10Web versions up to 1.8.37 contain a cross-site request forgery vulnerability that enables unauthenticated attackers to perform unauthorized actions on behalf of authenticated users through crafted requests. The vulnerability requires user interaction and allows attackers to modify or delete gallery content with no direct access needed. No patch is currently available for this vulnerability.