VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Photo Gallery by 10Web – Mobile-Friendly Image Gallery security & vulnerabilities

photo-gallery— active installsLast vulnerability Oct 14, 2026

No known unpatched vulnerabilities in the latest version

All 72 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
72Known vulnerabilities
  • Critical6
  • High8
  • Medium57
  • Low1
Vulnerabilities per year
2014: 2 vulnerabilities2142015: 5 vulnerabilities5152017: 4 vulnerabilities4172019: 6 vulnerabilities6192020: 2 vulnerabilities2202021: 9 vulnerabilities9212022: 11 vulnerabilities11222023: 3 vulnerabilities3232024: 14 vulnerabilities14242025: 4 vulnerabilities4252026: 12 vulnerabilities1226

All Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities

Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.1Reflected Cross-Site Scripting via 'title' Parameter
≤1.8.42Update to 1.8.43
CVE-2026-18557
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.8.47Update to 1.8.48
CVE-2026-42715
Medium6.1Reflected Cross-Site Scripting via 'thumb_url' Parameter
≤1.8.46Update to 1.8.47
CVE-2026-92974
High7.5Authenticated (Contributor+) PHP Object Injection
≤1.8.46Update to 1.8.47
CVE-2026-102377
Medium6.5Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
≤1.8.44Update to 1.8.45
CVE-2026-85652
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
≤1.8.44Update to 1.8.45
CVE-2026-86311
Medium6.1Reflected Cross-Site Scripting
<1.8.44Update to 1.8.44
CVE-2026-12865
Medium6.5Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter
≤1.8.41Update to 1.8.42
CVE-2026-9829
Medium6.5Authenticated (Contributor+) SQL Injection
≤1.8.41Update to 1.8.42
CVE-2026-49771
Medium6.5Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
≤1.8.40Update to 1.8.41
CVE-2026-7048
Medium4.3Cross-Site Request Forgery
≤1.8.37Update to 1.8.38
CVE-2026-32330
Medium5.3Missing Authorization to Unauthenticated Arbitrary Comment Deletion
≤1.8.36Update to 1.8.37
CVE-2026-1036
Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
≤1.8.38Update to 1.8.39
CVE-2026-27360
Medium6.1Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter
≤1.8.34Update to 1.8.35
CVE-2025-2269
Medium6.1Unauthenticated Stored Cross-Site Scripting
≤1.8.33Update to 1.8.34
CVE-2025-0613
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.8.32Update to 1.8.33
CVE-2024-13124
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.8.30Update to 1.8.31
CVE-2024-10704
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.8.30Update to 1.8.31
CVE-2024-9878
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.8.28Update to 1.8.29
CVE-2024-8670
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.8.27Update to 1.8.28
CVE-2024-44043
Medium6.8Authenticated (Contributor+) Path Traversal via esc_dir Function
≤1.8.23Update to 1.8.24
CVE-2024-5481
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG
≤1.8.23Update to 1.8.24
CVE-2024-5426
Medium4.3Missing Authorization to Notice Dismissal
≤1.8.25Update to 1.8.26
CVE-2024-35628
Medium5.3Missing Authorization
≤1.8.20Update to 1.8.21
CVE-2024-33586
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via SVG
≤1.8.21Update to 1.8.22
CVE-2024-2296
Medium6.1Reflected Cross-Site Scripting via 'image_id'
≤1.8.21Update to 1.8.22
CVE-2024-29808
Medium6.1Reflected Cross-Site Scripting via 'current_url'
≤1.8.21Update to 1.8.22
CVE-2024-29832
Medium6.1Reflected Cross-Site Scripting via 'thumb_url'
≤1.8.21Update to 1.8.22
CVE-2024-29810
Medium6.1Reflected Cross-Site Scripting via 'image_url'
≤1.8.21Update to 1.8.22
CVE-2024-29809
Critical9.1Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename
≤1.8.19Update to 1.8.20
CVE-2024-0221
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Widget
≤1.8.18Update to 1.8.19
CVE-2023-6924
Medium4.3Missing Authorization
<1.8.16Update to 1.8.16
CVE-2023-33995
Medium4.9Authenticated (Administrator+) Directory Traversal
≤1.8.14Update to 1.8.15
CVE-2023-1427
Medium6.1 Cross-Site Request Forgery to Stored Cross-Site Scripting
≤1.8.2Update to 1.8.3
CVE-2022-4058
Medium5.4Open Redirect
≤1.8.7Update to 1.8.8
—
Medium6.1Reflected Cross-Site Scripting
≤1.8.0Update to 1.8.1
—
Medium6.1Reflected Cross-Site Scripting
≤1.7.0Update to 1.7.1
—
Medium5.5Authenticated (Admin+) Cross-Site Scripting
≤1.6.8Update to 1.6.9
—
Medium6.1Authenticated (Admin+) Stored Cross-Site Scripting
≤1.6.7Update to 1.6.8
—
Medium6.1Reflected Cross-Site Scripting
≤1.6.6Update to 1.6.7
—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
<1.6.4Update to 1.6.4
CVE-2022-1394
Medium6.1Cross-Site Scripting
<1.6.3Update to 1.6.3
CVE-2022-1282
High8.8SQL Injection
<1.6.3Update to 1.6.3
CVE-2022-1281
Critical9.8Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter
<1.6.0Update to 1.6.0
CVE-2022-0169
Medium6.4Stored Cross-Site Scripting via Uploaded SVG
≤1.5.78Update to 1.5.79
—
Medium6.1Stored Cross-Site Scripting via Uploaded SVG
<1.5.75Update to 1.5.75
CVE-2021-24362
Medium4.9File Upload Path Traversal
<1.5.75Update to 1.5.75
CVE-2021-24363
Medium4.8Authenticated Stored Cross-Site Scripting via Gallery Title
<1.5.67Update to 1.5.67
CVE-2021-24310
Medium6.1Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site Scripting
≤1.5.68Update to 1.5.69
CVE-2021-31693
Medium6.1Reflected Cross-Site Scripting
≤1.5.68Update to 1.5.69
CVE-2021-46889
Medium6.1Multiple Reflected Cross-Site Scripting
<1.5.69Update to 1.5.69
CVE-2021-24291
Medium6.1Cross-Site Scripting
≤1.5.68Update to 1.5.69
—
Medium6.1Reflected Cross-Site Scripting
<1.5.68Update to 1.5.68
CVE-2021-25041
Critical9.8SQL Injection via bwg_search_x Parameter
<1.5.55Update to 1.5.55
CVE-2021-24139
Medium5.5Multiple Cross-Site Scripting Issues
≤1.5.45Update to 1.5.46
CVE-2020-9335
Critical9.8SQL Injection
<1.5.35Update to 1.5.35
CVE-2019-16119
Medium6.1 Cross-Site Scripting
≤1.5.34Update to 1.5.35
CVE-2019-16118
Medium6.1Cross-Site Scripting
<1.5.35Update to 1.5.35
CVE-2019-16117
Critical9.8SQL Injection
<1.5.31Update to 1.5.31
CVE-2019-14313
Medium4.9Authenticated Local File Inclusion
≤1.5.24Update to 1.5.25
CVE-2019-14798
Medium5.4Authenticated Cross-Site Scripting
≤1.5.22Update to 1.5.23
CVE-2019-14797
Medium6.1Cross-Site Scripting
<1.3.67Update to 1.3.67
—
High7.2Authenticated SQL Injection via tag_id Parameter
<1.3.51Update to 1.3.51
CVE-2017-12977
Medium4.1Authenticated Path Traversal
<1.3.43Update to 1.3.43
—
High8.8Authenticated SQL Injection
<1.3.38Update to 1.3.38
—
Medium5.4Authenticated Cross-Site Scripting
<1.2.13Update to 1.2.13
CVE-2015-2324
High8.8Unrestricted File Upload
<1.2.6Update to 1.2.6
CVE-2014-9312
Medium5.4Authenticated Cross-Site Scripting
<1.2.11Update to 1.2.11
CVE-2015-1394
High8.8Authenticated SQL Injection via asc_or_desc Parameter
<1.2.11Update to 1.2.11
CVE-2015-1393
Critical9.8Unauthenticated Blind SQL Injection via order_by Parameter
<1.2.8Update to 1.2.8
CVE-2015-1055
Low3.1Reflected Cross-Site Scripting
≤1.1.30Update to 1.1.31
CVE-2014-6315
High8.8Cross-Site Request Forgery
<1.2.42Update to 1.2.42
CVE-2015-9380

Photo Gallery by 10Web – Mobile-Friendly Image Gallery: common questions

Does Photo Gallery by 10Web – Mobile-Friendly Image Gallery have known vulnerabilities?

Yes. VulnCrest Radar lists 72 known vulnerabilities in Photo Gallery by 10Web – Mobile-Friendly Image Gallery: 6 critical, 8 high, 57 medium, 1 low. None are known to affect version null.

How do I check which version of Photo Gallery by 10Web – Mobile-Friendly Image Gallery I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerability?

CVE-2026-18557, published Oct 14, 2026: Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter. Severity: Medium (CVSS 6.1).

Is any Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerability listed in CISA KEV?

No. None of the known Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?