WordPress plugin
Photo Gallery by 10Web – Mobile-Friendly Image Gallery security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 72 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical6
- High8
- Medium57
- Low1
All Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤1.8.47Update to 1.8.48 | CVE-2026-42715 | |
| High7.5 | Authenticated (Contributor+) PHP Object Injection ≤1.8.46Update to 1.8.47 | CVE-2026-102377 | |
| Critical9.1 | Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename ≤1.8.19Update to 1.8.20 | CVE-2024-0221 | |
| High8.8 | SQL Injection <1.6.3Update to 1.6.3 | CVE-2022-1281 | |
| Critical9.8 | Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter <1.6.0Update to 1.6.0 | CVE-2022-0169 | |
| Critical9.8 | SQL Injection via bwg_search_x Parameter <1.5.55Update to 1.5.55 | CVE-2021-24139 | |
| Critical9.8 | SQL Injection <1.5.35Update to 1.5.35 | CVE-2019-16119 | |
| Critical9.8 | SQL Injection <1.5.31Update to 1.5.31 | CVE-2019-14313 | |
| High7.2 | Authenticated SQL Injection via tag_id Parameter <1.3.51Update to 1.3.51 | CVE-2017-12977 | |
| High8.8 | Authenticated SQL Injection <1.3.38Update to 1.3.38 | — | |
| High8.8 | Unrestricted File Upload <1.2.6Update to 1.2.6 | CVE-2014-9312 | |
| High8.8 | Authenticated SQL Injection via asc_or_desc Parameter <1.2.11Update to 1.2.11 | CVE-2015-1393 | |
| Critical9.8 | Unauthenticated Blind SQL Injection via order_by Parameter <1.2.8Update to 1.2.8 | CVE-2015-1055 | |
| High8.8 | Cross-Site Request Forgery <1.2.42Update to 1.2.42 | CVE-2015-9380 |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.8.47Update to 1.8.48
- High7.5Authenticated (Contributor+) PHP Object Injection
≤1.8.46Update to 1.8.47
- Critical9.1Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename
≤1.8.19Update to 1.8.20
- High8.8SQL Injection
<1.6.3Update to 1.6.3
- Critical9.8Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter
<1.6.0Update to 1.6.0
- Critical9.8SQL Injection via bwg_search_x Parameter
<1.5.55Update to 1.5.55
- Critical9.8SQL Injection
<1.5.35Update to 1.5.35
- Critical9.8SQL Injection
<1.5.31Update to 1.5.31
- High7.2Authenticated SQL Injection via tag_id Parameter
<1.3.51Update to 1.3.51
- High8.8Authenticated SQL Injection
<1.3.38Update to 1.3.38
- High8.8Unrestricted File Upload
<1.2.6Update to 1.2.6
- High8.8Authenticated SQL Injection via asc_or_desc Parameter
<1.2.11Update to 1.2.11
- Critical9.8Unauthenticated Blind SQL Injection via order_by Parameter
<1.2.8Update to 1.2.8
- High8.8Cross-Site Request Forgery
<1.2.42Update to 1.2.42
Photo Gallery by 10Web – Mobile-Friendly Image Gallery: common questions
Does Photo Gallery by 10Web – Mobile-Friendly Image Gallery have known vulnerabilities?
Yes. VulnCrest Radar lists 72 known vulnerabilities in Photo Gallery by 10Web – Mobile-Friendly Image Gallery: 6 critical, 8 high, 57 medium, 1 low. None are known to affect version null.
How do I check which version of Photo Gallery by 10Web – Mobile-Friendly Image Gallery I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerability?
CVE-2026-18557, published Oct 14, 2026: Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter. Severity: Medium (CVSS 6.1).
Is any Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerability listed in CISA KEV?
No. None of the known Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities is currently listed in the CISA KEV catalog.