CVE-2026-86311

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.45

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the shortcode attributes. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version newer than 1.8.44.