WordPress security by component

Photo Gallery

Photo Gallery (photo-gallery) is a WordPress plugin with 61 published CVE records in this archive. The latest tracked vulnerability was published Sep 18, 2026; the highest published CVSS base score is 9.8.

Plugin slug: photo-gallery

Latest vulnerability

CVE-2026-85652: Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Author-level stored SQL injection in gallery shortcodes

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An Author-level user can store a SQL injection payload inside a published post's shortcode attribute, causing the payload to execute when any visitor renders the post; notably, the unsanitized value appears on both sides of a UNION query, potentially doubling the observable time-based delay. The post-rendering path makes this a stored SQL injection; the export does not identify the exact query function or a standalone HTTP endpoint. Affected versions reported by the CNA: <= 1.8.44. No fixed release is confirmed for this CVE in this review.

PublishedSep 18, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for photo-gallery
		Safe version
Sep 18, 2026	CVE-2026-85652 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Author-level stored SQL injection in gallery shortcodes The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An Author-level user can store a SQL injection payload inside a published post's shortcode attribute, causing the payload to execute when any visitor renders the post; notably, the unsanitized value appears on both sides of a UNION query, potentially doubling the observable time-based delay. The post-rendering path makes this a stored SQL injection; the export does not identify the exact query function or a standalone HTTP endpoint. Affected versions reported by the CNA: <= 1.8.44. No fixed release is confirmed for this CVE in this review.	See mitigation notes	CVE6.5 NVDPending
Sep 17, 2026	CVE-2026-86311 Photo Gallery stores executable shortcode attribute values Photo Gallery by 10Web through 1.8.44 allows an Author or higher to supply shortcode attributes without sufficient sanitization or output escaping. Those values become stored page content that executes JavaScript when a user views the affected page. The export does not identify the shortcode name, vulnerable attributes or rendering function. Official release 1.8.46 is newer and may resolve the issue, but the 1.8.45 changelog says only Security fix and does not confirm this vulnerability's fixed boundary.	See mitigation notes	CVE6.4 NVDPending
Sep 02, 2026	CVE-2026-12865 Photo Gallery by 10Web permits administrator-targeted reflected cross-site scripting Photo Gallery by 10Web before 1.8.44 reflects two request values into input attributes on administration pages without adequate escaping. An unauthenticated attacker can craft a link whose auto-firing onfocus payload executes when opened by an administrator; the shortcode-page sink can also target a Contributor, while the gallery-list sink requires a populated site with more than 20 galleries or albums.	1.8.44	CVE7.1 NVDPending
Jun 06, 2026	CVE-2026-9829 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: SQL injection Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 1.8.41.	See mitigation notes	CVE6.5 NVDPending
Jun 04, 2026	CVE-2026-49771 Photo Gallery by 10Web: SQL injection Photo Gallery by 10Web is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 1.8.41.	1.8.42	CVE7.6 NVDPending
May 28, 2026	CVE-2026-7048 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: SQL injection Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 1.8.40.	See mitigation notes	CVE6.5 NVDPending
Mar 13, 2026	CVE-2026-32330 Photo Gallery by 10Web: Cross-site request forgery Photo Gallery by 10Web is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVDPending
Feb 19, 2026	CVE-2026-27360 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVDPending
Jan 22, 2026	CVE-2026-1036 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: A security weakness Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
May 15, 2025	CVE-2024-8670 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVDPending
Apr 12, 2025	CVE-2025-2269 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Cross-site scripting Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVDPending
Mar 31, 2025	CVE-2025-0613 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVDPending
Mar 24, 2025	CVE-2024-13124 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE3.5 NVDPending
Dec 13, 2024	CVE-2023-33995 Photo Gallery by 10Web: A security weakness Photo Gallery by 10Web is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVD4.3
Nov 29, 2024	CVE-2024-10704 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVDPending
Nov 05, 2024	CVE-2024-9878 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Cross-site scripting Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by cross-site scripting. Exploitation requires an authenticated administrator account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.4 NVD4.8
Oct 09, 2024	CVE-2024-5968 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVDPending
Oct 06, 2024	CVE-2024-44043 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.9 NVD4.8
Jun 11, 2024	CVE-2024-35628 Photo Gallery by 10Web: A security weakness Photo Gallery by 10Web is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVD4.3
Jun 07, 2024	CVE-2024-5481 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Filesystem traversal Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by filesystem traversal. Exploitation requires an authenticated WordPress account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE6.8 NVD8.8
Jun 07, 2024	CVE-2024-5426 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Cross-site scripting Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Apr 29, 2024	CVE-2024-33586 Photo Gallery by 10Web: A security weakness Photo Gallery by 10Web is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD5.3
Apr 18, 2024	CVE-2024-32583 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVD6.1
Apr 06, 2024	CVE-2024-2296 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Cross-site scripting Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by cross-site scripting. Exploitation requires an authenticated administrator account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.5 NVD4.8
Mar 26, 2024	CVE-2024-29833 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVD5.4
Mar 26, 2024	CVE-2024-29832 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVD6.1
Mar 26, 2024	CVE-2024-29810 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVD5.4
Mar 26, 2024	CVE-2024-29809 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVD5.4
Mar 26, 2024	CVE-2024-29808 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVD5.4
Feb 05, 2024	CVE-2024-0221 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Filesystem traversal Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by filesystem traversal. Exploitation requires an authenticated WordPress account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.1 NVD7.2
Jan 11, 2024	CVE-2023-6924 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exploitation requires an authenticated administrator account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.4 NVD4.8
Jun 12, 2023	CVE-2023-2568 Photo Gallery by Ays: Cross-site scripting Photo Gallery by Ays is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Jun 07, 2023	CVE-2021-46889 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Apr 17, 2023	CVE-2023-1427 Photo Gallery by 10Web: Filesystem traversal Photo Gallery by 10Web is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE4.9 NVD4.9
Dec 19, 2022	CVE-2022-4058 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD5.4
Nov 29, 2022	CVE-2021-31693 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Jun 08, 2022	CVE-2022-1394 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD4.8
May 02, 2022	CVE-2022-1282 Photo Gallery by 10Web: A security weakness Photo Gallery by 10Web is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVEPending NVD6.1
May 02, 2022	CVE-2022-1281 Photo Gallery: SQL injection Photo Gallery is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD9.8
Mar 14, 2022	CVE-2022-0169 Photo Gallery by 10Web: SQL injection Photo Gallery by 10Web is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD9.8
Dec 06, 2021	CVE-2021-25041 Photo Gallery by 10Web: Cross-site scripting Photo Gallery by 10Web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Aug 16, 2021	CVE-2021-24363 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Filesystem traversal Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVEPending NVD4.9
Aug 16, 2021	CVE-2021-24362 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Cross-site scripting Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Aug 02, 2021	CVE-2021-24462 get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery: SQL injection get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD8.8
Jun 01, 2021	CVE-2021-24310 Photo Gallery by 10Web - Mobile-Friendly Image Gallery: Cross-site scripting Photo Gallery by 10Web - Mobile-Friendly Image Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD4.8
May 14, 2021	CVE-2021-24291 Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Cross-site scripting Photo Gallery by 10Web – Mobile-Friendly Image Gallery is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Mar 18, 2021	CVE-2021-24139 Photo Gallery (10Web Photo Gallery): SQL injection Photo Gallery (10Web Photo Gallery) is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD9.8
Feb 25, 2020	CVE-2020-9335 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD4.8
Feb 08, 2020	CVE-2015-1394 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD5.4
Sep 08, 2019	CVE-2019-16119 Photo Gallery: SQL injection Photo Gallery is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD9.8
Sep 08, 2019	CVE-2019-16118 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Sep 08, 2019	CVE-2019-16117 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Aug 30, 2019	CVE-2015-9380 Photo Gallery: Cross-site request forgery Photo Gallery is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVEPending NVD8.8
Aug 09, 2019	CVE-2019-14798 Photo Gallery: Filesystem traversal Photo Gallery is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVEPending NVD4.9
Aug 09, 2019	CVE-2019-14797 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD5.4
Jul 30, 2019	CVE-2019-14313 Photo Gallery: SQL injection Photo Gallery is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD9.8
Feb 19, 2018	CVE-2015-2324 Photo Gallery: Cross-site scripting Photo Gallery is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD5.4
Aug 28, 2017	CVE-2014-9312 Photo Gallery: A security weakness Photo Gallery is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVEPending NVD8.8
Aug 21, 2017	CVE-2017-12977 Photo Gallery: SQL injection Photo Gallery is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD7.2
Feb 02, 2015	CVE-2015-1393 Photo Gallery: SQL injection Photo Gallery is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD6.5
Jan 16, 2015	CVE-2015-1055 Photo Gallery: SQL injection Photo Gallery is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD7.5

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers