Volerion logoVolerion
Volerion logoVolerion

Photo Gallery by 10Web WordPress Plugin Unauthenticated Stored Cross-Site Scripting Vulnerability

Vulnerability

A stored cross-site scripting vulnerability has been identified in the Photo Gallery by 10Web WordPress plugin, affecting versions prior to 1.8.34. The issue arises because the plugin fails to properly sanitize and escape comments added to images by unauthenticated users. This lack of proper handling allows for the injection of malicious scripts, which are executed when the comments are displayed.

Impact

Exploitation of this vulnerability allows for the injection of malicious scripts that are executed in the context of the user viewing the comments, leading to a stored cross-site scripting issue.

Remediation

Users are advised to update the Photo Gallery by 10Web WordPress plugin to version 1.8.34 or later.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
1.0
impact
1.7
exploitability
7.9
remediation
7.7
relevance
0.0
threat
6.4
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.