CVE-2026-92974

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.47

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the thumb url parameter when the editimage bwg AJAX action is triggered. While a capability check is performed, the lack of nonce verification allows a payload to be delivered through a crafted GET request. Successful exploitation requires the victim to have the manage options capability and be tricked into clicking a malicious link to execute arbitrary web scripts.

Recommendations Update the plugin to version 1.8.47 or later. As a temporary mitigation, restrict access to the editimage bwg AJAX action or avoid using the thumb url parameter until the update is applied.