What’s Vulnerable › Products
10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities
63 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.
Check whether your 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery version is affected
Latest 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities
- CVE-2026-18557 — Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter (CVSS 6.1)
- CVE-2026-42715 — WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-92974 — Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter (CVSS 6.1)
- CVE-2026-102377 — WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability (CVSS 8.8)
- CVE-2026-85652 — Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute (CVSS 6.5)
- CVE-2026-86311 — Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- CVE-2026-12865 — Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters (CVSS 7.1)
- CVE-2026-9829 — Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter (CVSS 6.5)
- CVE-2026-49771 — WordPress Photo Gallery by 10Web plugin <= 1.8.41 - SQL Injection vulnerability (CVSS 7.6)
- CVE-2026-7048 — Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute (CVSS 6.5)
- CVE-2026-32330 — WordPress Photo Gallery by 10Web plugin <= 1.8.37 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- CVE-2026-27360 — WordPress Photo Gallery by 10Web plugin <= 1.8.38 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- CVE-2026-1036 — Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion (CVSS 5.3)
- CVE-2024-8670 — Photo Gallery by 10Web < 1.8.29 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2025-2269 — Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter (CVSS 6.1)
- CVE-2025-0613 — Photo Gallery < 1.8.34 - Unauthenticated Stored XSS (CVSS 6.1)
- CVE-2024-13124 — Photo Gallery by 10Web < 1.8.33 - Admin+ Stored XSS (CVSS 3.5)
- CVE-2023-33995 — WordPress Photo Gallery by 10Web plugin <= 1.8.15 - Broken Access Control vulnerability (CVSS 4.3)
- CVE-2024-10704 — Photo Gallery by 10Web < 1.8.31 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2024-9878 — Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.8)
- CVE-2024-5968 — Photo Gallery by 10Web <= 1.8.27 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2024-44043 — WordPress Photo Gallery by 10Web plugin <= 1.8.27 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)
- CVE-2024-35628 — WordPress Photo Gallery by 10Web plugin <= 1.8.25 - Broken Access Control vulnerability (CVSS 4.3)
- CVE-2024-5481 — Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function (CVSS 8.8)
- CVE-2024-5426 — Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG (CVSS 5.4)