Description

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T06:17:15.917Z",
  "pubdate": "2026-09-02T06:17:15.917Z",
  "executiveSummary": "The Photo Gallery by 10Web WordPress plugin, specifically versions prior to 1.8.44, contains two reflected Cross-Site Scripting (XSS) vulnerabilities. These flaws arise from improper input sanitization of request parameters before they are reflected into HTML input-attribute values within the plugin's administrative interface.\nAn unauthenticated attacker can exploit these vulnerabilities by enticing a logged-in administrator or contributor to interact with a maliciously crafted URL. Successful exploitation results in the execution of arbitrary JavaScript within the context of the victim's authenticated session.\nThe attack poses a significant security risk, potentially leading to unauthorized administrative actions, session hijacking, or the theft of sensitive data. Exploitation of the secondary sink in the Galleries/Albums list page is contingent upon the site hosting more than 20 galleries or albums. Organizations utilizing affected versions of the Photo Gallery plugin are exposed to client-side injection attacks until the software is updated to version 1.8.44 or later.",
  "technicalDetails": "The vulnerability resides in the insufficient sanitization of request parameters within the Photo Gallery by 10Web admin pages. The root cause is the failure to properly escape user-supplied input before reflecting it into HTML input fields. Specifically, two distinct injection points exist: one located on the Shortcode management page and another on the Galleries/Albums list administrative page.\nThe exploitation vector involves an unauthenticated attacker crafting a URL containing a malicious JavaScript payload. This payload is designed to be injected into an input-attribute value, typically utilizing an 'onfocus' event handler. Because the application reflects this input back to the user without adequate context-aware encoding, the browser interprets the input as executable code when the element is focused.\nThe attack flow requires social engineering, as the attacker must persuade an authenticated user—an administrator for both sinks, or a contributor for the Shortcode sink—to navigate to the crafted URL. Once the victim loads the administrative page, the injected JavaScript executes within the security context of the victim's session. In the case of the Galleries/Albums list sink, the vulnerability only manifests when the target instance has more than 20 galleries or albums populated, as this condition dictates the rendering logic of the vulnerable UI component.\nBy triggering this vulnerability, an attacker can perform actions with the permissions of the authenticated user. This includes modifying plugin configurations, creating or deleting galleries, or injecting further malicious scripts into the WordPress site. The use of 'onfocus' handlers allows for an auto-firing mechanism, increasing the likelihood of successful payload execution immediately upon page rendering or interaction, thereby bypassing traditional static validation mechanisms.\nThe affected versions include all releases of Photo Gallery by 10Web prior to 1.8.44. The vulnerability is categorized as reflected XSS because the payload is not stored persistently on the server but is processed and reflected in real-time during the request-response cycle, making it a critical concern for administrative session security."
}