EN ES
Start free
Menu

Photo Gallery by 10Web: known security problems

72 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 72 known security problems on this page. Each one has a fixed version. Updating to version 1.8.48 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.42)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.42
Fixed in
1.8.43
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.43 or newer.
Official ID
CVE-2026-18557
Report title
Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 1.8.47)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.47
Fixed in
1.8.48
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.48 or newer.
Official ID
CVE-2026-42715
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.47 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.46)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.46
Fixed in
1.8.47
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.47 or newer.
Official ID
CVE-2026-92974
Report title
Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter
First reported
Sources
This week

Someone with a contributor account on your site could in some setups, take over your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.46
Fixed in
1.8.47
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.47 or newer.
Official ID
CVE-2026-102377
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection
First reported
Sources
This week

Someone with an author account on your site could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.44
Fixed in
1.8.45
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.45 or newer.
Official ID
CVE-2026-85652
Report title
Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.8.44)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.44
Fixed in
1.8.45
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.45 or newer.
Official ID
CVE-2026-86311
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.8.44)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.8.44
Fixed in
1.8.44
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.44 or newer.
Official ID
CVE-2026-12865
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery < 1.8.44 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 1.8.41)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.41
Fixed in
1.8.42
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.42 or newer.
Official ID
CVE-2026-9829
Report title
Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 1.8.41) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.41
Fixed in
1.8.42
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.42 or newer.
Official ID
CVE-2026-49771
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database (up to and including 1.8.40)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.40
Fixed in
1.8.41
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.41 or newer.
Official ID
CVE-2026-7048
Report title
Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 1.8.37)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.37
Fixed in
1.8.38
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.38 or newer.
Official ID
CVE-2026-32330
Report title
Photo Gallery by 10Web <= 1.8.37 - Cross-Site Request Forgery
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.36
Fixed in
1.8.37
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.37 or newer.
Official ID
CVE-2026-1036
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion
First reported
Sources
This week

Someone with an editor account on your site could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.38
Fixed in
1.8.39
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.39 or newer.
Official ID
CVE-2026-27360
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.38 - Authenticated (Editor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.34)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.34
Fixed in
1.8.35
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.35 or newer.
Official ID
CVE-2025-2269
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 1.8.33)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.33
Fixed in
1.8.34
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.34 or newer.
Official ID
CVE-2025-0613
Report title
Photo Gallery by 10Web <= 1.8.33 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.32)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.32
Fixed in
1.8.33
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.33 or newer.
Official ID
CVE-2024-13124
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.32 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.30)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.30
Fixed in
1.8.31
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.31 or newer.
Official ID
CVE-2024-10704
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.30 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 1.8.30)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.30
Fixed in
1.8.31
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.31 or newer.
Official ID
CVE-2024-9878
Report title
Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 1.8.28)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.28
Fixed in
1.8.29
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.29 or newer.
Official ID
CVE-2024-8670
Report title
Photo Gallery by 10Web <= 1.8.28 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 1.8.27)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.27
Fixed in
1.8.28
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.28 or newer.
Official ID
CVE-2024-44043
Report title
Photo Gallery by 10Web <= 1.8.27 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.23
Fixed in
1.8.24
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.24 or newer.
Official ID
CVE-2024-5481
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 1.8.23)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.23
Fixed in
1.8.24
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.24 or newer.
Official ID
CVE-2024-5426
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 1.8.25)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.25
Fixed in
1.8.26
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.26 or newer.
Official ID
CVE-2024-35628
Report title
Photo Gallery by 10Web <= 1.8.25 - Missing Authorization to Notice Dismissal
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 1.8.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.20
Fixed in
1.8.21
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.21 or newer.
Official ID
CVE-2024-33586
Report title
Photo Gallery by 10Web <= 1.8.20 - Missing Authorization
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.21)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.21
Fixed in
1.8.22
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.22 or newer.
Official ID
CVE-2024-2296
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.21) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.21
Fixed in
1.8.22
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.22 or newer.
Official ID
CVE-2024-29809
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_url'
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.21) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.21
Fixed in
1.8.22
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.22 or newer.
Official ID
CVE-2024-29832
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'current_url'
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.21) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.21
Fixed in
1.8.22
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.22 or newer.
Official ID
CVE-2024-29808
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_id'
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.21) (5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.21
Fixed in
1.8.22
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.22 or newer.
Official ID
CVE-2024-29810
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'thumb_url'
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.8.19)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.19
Fixed in
1.8.20
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.20 or newer.
Official ID
CVE-2024-0221
Report title
Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 1.8.18)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.18
Fixed in
1.8.19
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.19 or newer.
Official ID
CVE-2023-6924
Report title
Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 1.8.16)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.8.16
Fixed in
1.8.16
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.16 or newer.
Official ID
CVE-2023-33995
Report title
Photo Gallery <= 1.8.15 - Missing Authorization
First reported
Sources
This week

Someone who already has an admin account could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.14
Fixed in
1.8.15
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.15 or newer.
Official ID
CVE-2023-1427
Report title
Photo Gallery by 10Web <= 1.8.14 - Authenticated (Administrator+) Directory Traversal
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.2
Fixed in
1.8.3
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.3 or newer.
Official ID
CVE-2022-4058
Report title
Photo Gallery <= 1.8.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
First reported
Sources
This week

Someone could send your visitors from your site to a harmful site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.7
Fixed in
1.8.8
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.8 or newer.
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.7 - Open Redirect
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.8.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.0
Fixed in
1.8.1
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.8.1 or newer.
Report title
Photo Gallery by 10Web <= 1.8.0 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.7.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.7.0
Fixed in
1.7.1
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.7.1 or newer.
Report title
Photo Gallery <= 1.7.0 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.6.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.6.8
Fixed in
1.6.9
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.6.9 or newer.
Report title
Photo Gallery by 10Web <= 1.6.8 - Authenticated (Admin+) Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.6.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.6.7
Fixed in
1.6.8
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.6.8 or newer.
Report title
Photo Gallery by 10Web <= 1.6.7 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.6.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.6.6
Fixed in
1.6.7
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.6.7 or newer.
Report title
Photo Gallery by 10Web <= 1.6.6 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.6.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.6.4
Fixed in
1.6.4
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.6.4 or newer.
Official ID
CVE-2022-1394
Report title
Photo Gallery by 10Web <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 1.6.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.6.3
Fixed in
1.6.3
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.6.3 or newer.
Official ID
CVE-2022-1281
Report title
Photo Gallery by 10Web <= 1.6.2 - SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.6.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.6.3
Fixed in
1.6.3
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.6.3 or newer.
Official ID
CVE-2022-1282
Report title
Photo Gallery by 10Web <= 1.6.2 - Cross-Site Scripting
First reported
Sources
This week

A stranger could read or change the data in your site’s database (before 1.6.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.6.0
Fixed in
1.6.0
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.6.0 or newer.
Official ID
CVE-2022-0169
Report title
Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.78)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.78
Fixed in
1.5.79
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.79 or newer.
Report title
Photo Gallery by 10Web <= 1.5.78 - Stored Cross-Site Scripting via Uploaded SVG
First reported
Sources
This week

Someone could read or delete private files on your server (before 1.5.75)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.75
Fixed in
1.5.75
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.75 or newer.
Official ID
CVE-2021-24363
Report title
Photo Gallery <= 1.5.74 - File Upload Path Traversal
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.5.75)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.75
Fixed in
1.5.75
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.75 or newer.
Official ID
CVE-2021-24362
Report title
Photo Gallery <= 1.5.74 - Stored Cross-Site Scripting via Uploaded SVG
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.5.67)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.67
Fixed in
1.5.67
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.67 or newer.
Official ID
CVE-2021-24310
Report title
Photo Gallery <= 1.5.66 - Authenticated Stored Cross-Site Scripting via Gallery Title
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.68)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.68
Fixed in
1.5.69
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.69 or newer.
Official ID
CVE-2021-46889
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.5.68 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.5.69)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.69
Fixed in
1.5.69
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.69 or newer.
Official ID
CVE-2021-24291
Report title
Photo Gallery <= 1.5.68 - Multiple Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.68) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.68
Fixed in
1.5.69
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.69 or newer.
Official ID
CVE-2021-31693
Report title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.5.68 - Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.68) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.68
Fixed in
1.5.69
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.69 or newer.
Report title
Photo Gallery by 10Web <= 1.5.68 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.5.68)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.68
Fixed in
1.5.68
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.68 or newer.
Official ID
CVE-2021-25041
Report title
Photo Gallery <= 1.5.67 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 1.5.55)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.55
Fixed in
1.5.55
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.55 or newer.
Official ID
CVE-2021-24139
Report title
Photo Gallery by 10Web <= 1.5.54 - SQL Injection via bwg_search_x Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.45)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.45
Fixed in
1.5.46
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.46 or newer.
Official ID
CVE-2020-9335
Report title
Photo Gallery by 10Web <= 1.5.45 - Multiple Cross-Site Scripting Issues
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.34)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.34
Fixed in
1.5.35
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.35 or newer.
Official ID
CVE-2019-16118
Report title
Photo Gallery by 10Web <= 1.5.34 - Cross-Site Scripting
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 1.5.35)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.35
Fixed in
1.5.35
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.35 or newer.
Official ID
CVE-2019-16119
Report title
Photo Gallery by 10Web <= 1.5.34 - SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.5.35)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.35
Fixed in
1.5.35
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.35 or newer.
Official ID
CVE-2019-16117
Report title
Photo Gallery by 10Web <= 1.5.34 - Cross-Site Scripting
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 1.5.31)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.31
Fixed in
1.5.31
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.31 or newer.
Official ID
CVE-2019-14313
Report title
Photo Gallery by 10Web <= 1.5.30 - SQL Injection
First reported
Sources
This week

Someone could read or delete private files on your server (up to and including 1.5.24)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.24
Fixed in
1.5.25
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.25 or newer.
Official ID
CVE-2019-14798
Report title
Photo Gallery by 10Web <= 1.5.24 - Authenticated Local File Inclusion
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.22)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.5.22
Fixed in
1.5.23
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.5.23 or newer.
Official ID
CVE-2019-14797
Report title
Photo Gallery by 10Web <= 1.5.22 - Authenticated Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.3.67)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.3.67
Fixed in
1.3.67
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.3.67 or newer.
Report title
Photo Gallery by 10Web <= 1.3.66 - Cross-Site Scripting
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 1.3.51)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.3.51
Fixed in
1.3.51
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.3.51 or newer.
Official ID
CVE-2017-12977
Report title
Photo Gallery by 10Web <= 1.3.50 - Authenticated SQL Injection via tag_id Parameter
First reported
Sources
This week

Someone could read or delete private files on your server (before 1.3.43)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.3.43
Fixed in
1.3.43
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.3.43 or newer.
Report title
Photo Gallery by 10Web < 1.3.43 - Authenticated Path Traversal
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 1.3.38)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.3.38
Fixed in
1.3.38
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.3.38 or newer.
Report title
Photo Gallery by 10Web <= 1.3.37 - Authenticated SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.2.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.2.13
Fixed in
1.2.13
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.2.13 or newer.
Official ID
CVE-2015-2324
Report title
Photo Gallery by 10Web <= 1.2.12 - Authenticated Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (before 1.2.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.2.6
Fixed in
1.2.6
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.2.6 or newer.
Official ID
CVE-2014-9312
Report title
Photo Gallery by 10Web <= 1.2.5 - Unrestricted File Upload
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.2.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.2.11
Fixed in
1.2.11
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.2.11 or newer.
Official ID
CVE-2015-1394
Report title
Photo Gallery by 10Web <= 1.2.10 - Authenticated Cross-Site Scripting
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 1.2.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.2.11
Fixed in
1.2.11
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.2.11 or newer.
Official ID
CVE-2015-1393
Report title
Photo Gallery by 10Web <= 1.2.10 - Authenticated SQL Injection via asc_or_desc Parameter
First reported
Sources
This week

A stranger could read or change the data in your site’s database (before 1.2.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.2.8
Fixed in
1.2.8
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.2.8 or newer.
Official ID
CVE-2015-1055
Report title
Photo Gallery by 10Web <= 1.2.7 - Unauthenticated Blind SQL Injection via order_by Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.1.30)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.1.30
Fixed in
1.1.31
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.1.31 or newer.
Official ID
CVE-2014-6315
Report title
Photo Gallery by 10Web <= 1.1.30 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (before 1.2.42)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.2.42
Fixed in
1.2.42
What to do
If your site has an affected version, update Photo Gallery by 10Web to version 1.2.42 or newer.
Official ID
CVE-2015-9380
Report title
Photo Gallery by 10Web <= 1.2.41 - Cross-Site Request Forgery
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)