CVE-2026-12865
Received Received - Intake

Reflected XSS in Photo Gallery by 10Web WordPress Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-12865
EUVD
EUVD-2026-69870

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
10web photo_gallery to 1.8.44 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in the Photo Gallery by 10Web WordPress plugin before version 1.8.44. The plugin fails to escape two request parameters, 'title' and 'paged', before reflecting them into input-attribute values on admin pages. An unauthenticated attacker can craft a malicious link that executes arbitrary JavaScript in the victim's authenticated session when opened by a logged-in administrator or contributor.

Detection Guidance

To detect this vulnerability, check if the Photo Gallery by 10Web plugin version is below 1.8.44. Inspect admin pages for reflected parameters 'title' and 'paged' in URLs. Look for unexpected JavaScript execution in authenticated sessions.

Impact Analysis

An attacker could trick a logged-in administrator or contributor into clicking a malicious link, allowing the attacker to execute arbitrary JavaScript in the victim's authenticated session. This could lead to unauthorized actions, data theft, or further compromise of the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using the affected plugin versions may face legal and financial penalties if sensitive data is compromised.

Mitigation Strategies

Immediately update the Photo Gallery by 10Web plugin to version 1.8.44 or later. Remove or disable the plugin if an update is not possible. Restrict access to admin pages for untrusted users until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12865. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart