PT-2026-145701
CVE-2026-110072
·
Published
2026-11-12
·
Updated
2026-11-12
Description by
CVSS 3.1
6.8
MediumMetricsAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾