10web Photo Gallery

10Web Photo Gallery <=1.8.37 CSRF Vulnerability
CVE-2026-32330 4.3 - Medium - March 13, 2026

Cross-Site Request Forgery (CSRF) vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Cross Site Request Forgery.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.37.

Session Riding

10Web Photo Gallery <=1.8.37 Stored XSS
CVE-2026-27360 - February 19, 2026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.37.

XSS

Unauth Delete via delete_comment() in 10Web Photo Gallery 1.8.36
CVE-2026-1036 5.3 - Medium - January 21, 2026

The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_comment() function in all versions up to, and including, 1.8.36. This makes it possible for unauthenticated attackers to delete arbitrary image comments. Note: comments functionality is only available in the Pro version of the plugin.

AuthZ

Photo Gallery by 10Web WP plugin <1.8.29: Stored XSS via unsanitized settings
CVE-2024-8670 - May 15, 2025

The Photo Gallery by 10Web WordPress plugin before 1.8.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

XSS

XSS via image_id in Photo Gallery by 10Web WP plugin up to 1.8.34
CVE-2025-2269 6.1 - Medium - April 12, 2025

The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the image_id parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.

XSS

10Web Photo Gallery WP Plugin XSS before 1.8.34 Unauthenticated Stored-XSS
CVE-2025-0613 - March 31, 2025

The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed

XSS

Stored XSS in 10Web PhotoGallery WP plugin before 1.8.33
CVE-2024-13124 - March 24, 2025

The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

XSS

Missing Auth in Photo Gallery by 10Web <1.8.15, Access Control Bypass
CVE-2023-33995 4.3 - Medium - December 13, 2024

Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15.

AuthZ

Stored XSS Vulnerability in Photo Gallery by 10Web WordPress Plugin
CVE-2024-10704 - November 29, 2024

The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

XSS

10Web Gallery XSS in Admin Settings
CVE-2024-9878 4.8 - Medium - November 05, 2024

The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

XSS

XSS via Gallery settings in The Photo Gallery by 10Web v<1.8.28
CVE-2024-5968 - October 09, 2024

The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

10Web Photo Gallery 1.8.27 XSS via unsanitized input: Stored XSS
CVE-2024-44043 - October 06, 2024

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.27.

XSS

Missing Auth CVE-2024-35628: Photo Gallery by 10Web <=1.8.25
CVE-2024-35628 4.3 - Medium - June 11, 2024

Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.25.

AuthZ

10Web Photo Gallery 1.8.23 Path Traversal via esc_dir
CVE-2024-5481 6.8 - Medium - June 07, 2024

The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the esc_dir function. This makes it possible for authenticated attackers to cut and paste (copy) the contents of arbitrary files on the server, which can contain sensitive information, and to cut (delete) arbitrary directories, including the root WordPress directory. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery edit permissions to lower level users, which might make this exploitable by users as low as contributors.

Path Traversal: '.../...//'

Stored XSS via svg param in Photo Gallery <=1.8.23 (WordPress)
CVE-2024-5426 6.4 - Medium - June 07, 2024

The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the svg parameter in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure Photo Gallery can be extended to contributors on pro versions of the plugin.

XSS

Missing Auth in Photo Gallery by 10Web before 1.8.20
CVE-2024-33586 5.3 - Medium - April 29, 2024

Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.20.

AuthZ

Photo Gallery by 10Web <=1.8.21 Reflected XSS
CVE-2024-32583 6.1 - Medium - April 18, 2024

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Reflected XSS.This issue affects Photo Gallery by 10Web: from n/a through 1.8.21.

XSS

XSS via SVG Uploads in 10Web Photo Gallery WP <=1.8.21
CVE-2024-2296 5.5 - Medium - April 06, 2024

The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.8.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE-2024-29833 appears to be a duplicate of this issue.

XSS

WordPress bwg AJAX XSS via image_id in editimage_bwg
CVE-2024-29808 5.4 - Medium - March 26, 2024

The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

Reflected XSS via thumb_url in bwg editimage AJAX
CVE-2024-29810 5.4 - Medium - March 26, 2024

The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

Reflected XSS via image_url in bwg admin-ajax.php (WordPress plugin)
CVE-2024-29809 5.4 - Medium - March 26, 2024

The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

XSS via SVG Bypass in Image Upload Component (CVE-2024-29833)
CVE-2024-29833 5.4 - Medium - March 26, 2024

The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.

Reflected XSS via current_url in GalleryBox AJAX (WP plugin)
CVE-2024-29832 6.1 - Medium - March 26, 2024

The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.

Directory Traversal 10Web Photo Gallery <=1.8.19 rename_item
CVE-2024-0221 9.1 - Critical - February 05, 2024

The Photo Gallery by 10Web Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitrary files on the server. This can lead to site takeovers if the wp-config.php file of a site can be renamed. By default this can be exploited by administrators only. In the premium version of the plugin, administrators can give gallery management permissions to lower level users, which might make this exploitable by users as low as contributors.

Directory traversal

Stored XSS in 10Web Photo Gallery WP Plugin <=1.8.18 via Widget
CVE-2023-6924 4.4 - Medium - January 11, 2024

The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. It can also be exploited with a contributor-level permission with a page builder plugin.

XSS

10Web Photo Gallery WP Plugin XSS via theme_id in 10Web Photo Gallery <=1.5.69
CVE-2021-46889 6.1 - Medium - June 07, 2023

The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.

XSS

Photo Gallery 10Web WP Plugin v<1.8.15 Path Traversal Allowing High-Priv Users
CVE-2023-1427 4.9 - Medium - April 17, 2023

- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.

Directory traversal

Stored XSS in 10Web Photo Gallery plugin before 1.8.3
CVE-2022-4058 5.4 - Medium - December 19, 2022

The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.

Session Riding

The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could
CVE-2022-1394 4.8 - Medium - June 08, 2022

The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed

XSS

The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable
CVE-2022-1282 6.1 - Medium - May 02, 2022

The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.

XSS

The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter
CVE-2022-1281 9.8 - Critical - May 02, 2022

The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.

SQL Injection

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement
CVE-2022-0169 9.8 - Critical - March 14, 2022

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection

SQL Injection

The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues
CVE-2021-25041 6.1 - Medium - December 06, 2021

The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action

XSS

The Photo Gallery by 10Web â Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure
CVE-2021-24363 4.9 - Medium - August 16, 2021

The Photo Gallery by 10Web â Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector

Directory traversal

The Photo Gallery by 10Web â Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure
CVE-2021-24362 6.1 - Medium - August 16, 2021

The Photo Gallery by 10Web â Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly (ie in the /wp-content/uploads/photo-gallery/ folder), leading to a Cross-Site Scripting (XSS) issue

XSS

The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title
CVE-2021-24310 4.8 - Medium - June 01, 2021

The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117

XSS

The Photo Gallery by 10Web â Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues
CVE-2021-24291 6.1 - Medium - May 14, 2021

The Photo Gallery by 10Web â Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)

XSS

Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection
CVE-2021-24139 9.8 - Critical - March 18, 2021

Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.

SQL Injection

Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress
CVE-2020-9335 - February 25, 2020

Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users.

SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists
CVE-2019-16119 9.8 - Critical - September 08, 2019

SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.

SQL Injection

Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists
CVE-2019-16118 6.1 - Medium - September 08, 2019

Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.

XSS

Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists
CVE-2019-16117 6.1 - Medium - September 08, 2019

Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.

XSS

The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion
CVE-2019-14798 - August 09, 2019

The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.

The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
CVE-2019-14797 - August 09, 2019

The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.

A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress
CVE-2019-14313 - July 30, 2019

A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via filemanager/model.php.