{"id":"CVE-2026-12865","aliases":["EUVD-2026-69870","GHSA-487r-gpmr-7hw3"],"status":"published","title":"Photo Gallery by 10Web \u003c 1.8.44 - Reflected XSS via title and paged Parameters","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00282,"percentile":0.20869,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-09-02T06:00:16Z","modified":"2026-09-03T17:49:19Z","products":[{"vendor":"10web","product":"photo gallery by 10web"},{"vendor":"unknown","product":"photo gallery by 10web"}],"references":[{"url":"https://wpscan.com/vulnerability/a78cc4ca-120e-4b6e-9285-34dcaa0bca77/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12865"},{"url":"https://wpscan.com/vulnerability/a78cc4ca-120e-4b6e-9285-34dcaa0bca77"},{"url":"https://github.com/advisories/GHSA-487r-gpmr-7hw3"}],"sources":{"cve":[{"id":"CVE-2026-12865","title":"Photo Gallery by 10Web \u003c 1.8.44 - Reflected XSS via title and paged Parameters","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).","status":"published","published":"2026-09-02T06:00:16.384Z","modified":"2026-09-02T10:45:59.458Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-69870","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).","status":"published","published":"2026-09-02T06:00:16Z","modified":"2026-09-02T10:45:59Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:01:16.444637Z"}],"ghsa":[{"id":"GHSA-487r-gpmr-7hw3","title":"The Photo Gallery by 10Web  WordPress plugin before 1.8.44 does not escape two request parameters...","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).","status":"published","published":"2026-09-02T06:31:14Z","modified":"2026-09-02T12:31:27Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:11:16.032844Z"}],"nvd":[{"id":"CVE-2026-12865","description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).","status":"published","published":"2026-09-02T06:17:15.917Z","modified":"2026-09-03T17:49:19.18Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:43.04945Z"}]}}