{"id":"CVE-2025-0613","aliases":["EUVD-2025-8715","GHSA-r3r3-hjgr-8x9f"],"status":"published","title":"Photo Gallery \u003c 1.8.34 - Unauthenticated Stored XSS","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00301,"percentile":0.23053,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-03-31T06:00:01Z","modified":"2026-06-17T08:26:50Z","products":[{"vendor":"10web","product":"photo gallery by 10web"},{"vendor":"10web","product":"photo_gallery"},{"vendor":"unknown","product":"photo gallery by 10web"}],"references":[{"url":"https://wpscan.com/vulnerability/22be2b44-cd42-4b02-8448-59dd2989dde1/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0613"},{"url":"https://wpscan.com/vulnerability/22be2b44-cd42-4b02-8448-59dd2989dde1"},{"url":"https://github.com/advisories/GHSA-r3r3-hjgr-8x9f"}],"sources":{"cve":[{"id":"CVE-2025-0613","title":"Photo Gallery \u003c 1.8.34 - Unauthenticated Stored XSS","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed","status":"published","published":"2025-03-31T06:00:01.529Z","modified":"2025-03-31T14:59:55.246Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:53.475217Z"}],"euvd":[{"id":"EUVD-2025-8715","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed","status":"published","published":"2025-03-31T06:00:01Z","modified":"2025-03-31T14:59:55Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:46.759966Z"}],"ghsa":[{"id":"GHSA-r3r3-hjgr-8x9f","title":"The Photo Gallery by 10Web  WordPress plugin before 1.8.34 does not sanitised and escaped comment...","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed","status":"published","published":"2025-03-31T06:30:27Z","modified":"2025-05-13T15:33:18Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:15.83063Z"}],"nvd":[{"id":"CVE-2025-0613","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed","status":"published","published":"2025-03-31T06:15:29.463Z","modified":"2026-06-17T08:26:50.22Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:56.494516Z"}]}}