CVE-2026-12865

Photo Gallery by 10Web, a WordPress gallery plugin, fails to escape two request parameters that are reflected into input-attribute values on its admin pages, allowing arbitrary JavaScript to execute via an auto-firing onfocus handler. An unauthenticated attacker must craft a malicious link and get a logged-in user to open it: the Shortcode-page sink can be triggered via a contributor account, while the Galleries/Albums list-page sink targets administrators and only renders on sites with more than 20 galleries or albums (the typical state of a populated install). Successful exploitation runs attacker-controlled JavaScript in the victim's authenticated session, enabling actions such as modifying content or creating rogue administrator accounts. Any WordPress site running the plugin before 1.8.44 is affected; there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts the 30-day exploitation probability at only about 0.2%.

What to do: Update Photo Gallery by 10Web to version 1.8.44 or later. Although no public exploits are known and EPSS indicates low near-term risk, patch promptly because successful attacks execute JavaScript in an administrator's session and can create rogue admin accounts. Owners who cannot update immediately should review recently created administrator accounts and content changes, and be wary of links pointing to the plugin's admin pages.