CVE-2026-12865: unknown photo gallery by 10web Cross-site Scripting

Vulnerability summary

CVE-2026-12865 is a high (CVSS 7.1) Cross-site Scripting vulnerability in unknown photo gallery by 10web. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.8.44.

Timeline

1. 02-09-2026
   PublishedVulnerability first disclosed.
2. 02-09-2026
   Last modifiedVulnerability information updated.

Description

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.