WordPress plugin · photo-gallery
Is Photo Gallery by 10Web safe?
Safe on 1.8.48 or newer.
The current version, 1.8.48, is past every affected range on record (60 of 60 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 60
- High or critical
- 13
- Exploited
- none
- Current version
- 1.8.48
- Last updated
- Oct 15, 2026
- Active installs
- 100,000+
Every recorded flaw
- Oct 15, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2026-18557 · affects up to 1.8.42 · reported by WordfenceMedium 6.1
- Oct 10, 2026Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.CVE-2026-42715 · affects up to 1.8.47 · reported by PatchstackHigh 7.1
- Oct 3, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2026-92974 · affects up to 1.8.46 · reported by WordfenceMedium 6.1
- Sep 30, 2026Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.CVE-2026-102377 · affects up to 1.8.46 · reported by PatchstackHigh 8.8
- Sep 18, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Time-based SQL InjectionCVE-2026-85652 · affects up to 1.8.44 · reported by WordfenceMedium 6.5
- Sep 17, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Stored Cross-Site ScriptingCVE-2026-86311 · affects up to 1.8.44 · reported by WordfenceMedium 6.4
- Sep 2, 2026Photo Gallery by 10Web: Does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode pageCVE-2026-12865 · fixed in 1.8.44 · reported by WPScanHigh 7.1
- Jun 6, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Time-based SQL InjectionCVE-2026-9829 · affects up to 1.8.41 · reported by WordfenceMedium 6.5
- Jun 4, 2026Photo Gallery by 10Web: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49771 · affects up to 1.8.41 · reported by PatchstackHigh 7.6
- May 28, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Time-based blind SQL InjectionCVE-2026-7048 · affects up to 1.8.40 · reported by WordfenceMedium 6.5
- Mar 13, 2026Photo Gallery by 10Web: Cross-Site Request Forgery (CSRF)CVE-2026-32330 · affects up to 1.8.37 · reported by PatchstackMedium 4.3
- Feb 19, 2026Photo Gallery by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27360 · affects up to 1.8.38 · reported by PatchstackMedium 5.9
- Jan 21, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Unauthorized modification of dataCVE-2026-1036 · affects up to 1.8.36 · reported by WordfenceMedium 5.3
- May 15, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-8670 · fixed in 1.8.29 · reported by WPScanMedium 4.8
- Apr 11, 2025Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2025-2269 · affects up to 1.8.34 · reported by WordfenceMedium 6.1
- Mar 31, 2025Photo Gallery by 10Web: Does not sanitised and escaped comment added on images by unauthenticated usersCVE-2025-0613 · fixed in 1.8.34 · reported by WPScanMedium 6.1
- Mar 24, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13124 · fixed in 1.8.33 · reported by WPScanLow 3.5
- Dec 13, 2024Photo Gallery by 10Web: Missing AuthorizationCVE-2023-33995 · affects up to 1.8.15 · reported by PatchstackMedium 4.3
- Nov 29, 2024Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10704 · fixed in 1.8.31 · reported by WPScanMedium 4.8
- Nov 5, 2024Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Stored Cross-Site ScriptingCVE-2024-9878 · affects up to 1.8.30 · reported by WordfenceMedium 4.4
- Oct 9, 2024Photo Gallery by 10Web: Does not properly sanitise and escape some of its Gallery settingsCVE-2024-5968 · fixed in 1.8.28 · reported by WPScanMedium 4.8
- Oct 6, 2024Photo Gallery by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44043 · affects up to 1.8.27 · reported by PatchstackMedium 5.9
- Jun 11, 2024Photo Gallery by 10Web: Missing AuthorizationCVE-2024-35628 · affects up to 1.8.25 · reported by PatchstackMedium 4.3
- Jun 7, 2024Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Path TraversalCVE-2024-5481 · affects up to 1.8.23 · reported by WordfenceMedium 6.8
- Jun 7, 2024Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Stored Cross-Site ScriptingCVE-2024-5426 · affects up to 1.8.23 · reported by WordfenceMedium 6.4
- Apr 29, 2024Photo Gallery by 10Web: Missing AuthorizationCVE-2024-33586 · affects up to 1.8.20 · reported by PatchstackMedium 5.3
- Apr 18, 2024Photo Gallery by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32583 · affects up to 1.8.21 · reported by PatchstackHigh 7.1
- Apr 6, 2024Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Stored Cross-Site ScriptingCVE-2024-2296 · affects up to 1.8.21 · reported by WordfenceMedium 5.5
- Mar 26, 2024The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which CVE-2024-29833 · fixed in 1.8.22 · reported by info@appcheck-ng.comMedium 5.4
- Mar 26, 2024The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29832 · fixed in 1.8.22 · reported by info@appcheck-ng.comMedium 6.1
- Mar 26, 2024The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29810 · fixed in 1.8.22 · reported by info@appcheck-ng.comMedium 5.4
- Mar 26, 2024The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29809 · fixed in 1.8.22 · reported by info@appcheck-ng.comMedium 5.4
- Mar 26, 2024The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29808 · fixed in 1.8.22 · reported by info@appcheck-ng.comMedium 5.4
- Feb 5, 2024Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Directory TraversalCVE-2024-0221 · affects up to 1.8.19 · reported by Wordfence1.3% oddsCritical 9.1
- Jan 11, 2024Photo Gallery by 10Web: Stored Cross-Site ScriptingCVE-2023-6924 · affects up to 1.8.18 · reported by WordfenceMedium 4.4
- Jun 7, 2023The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data.CVE-2021-46889 · affects up to 1.5.69 · reported by MITREMedium 6.1
- Dec 19, 2022Photo Gallery by 10Web: Does not validate and escape some parameters before outputting them back in in JS code later on in another pageCVE-2022-4058 · fixed in 1.8.3 · reported by WPScanMedium 5.4
- Nov 29, 2022The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data.CVE-2021-31693 · affects up to 1.5.68 · reported by MITREMedium 6.1
- Jun 8, 2022Photo Gallery by 10Web: Does not properly validate and escape some of its settingsCVE-2022-1394 · fixed in 1.6.4 · reported by WPScan1.1% oddsMedium 4.8
- May 2, 2022Photo Gallery by 10Web: Does not properly sanitize the $_GET['image_url'] variableCVE-2022-1282 · fixed in 1.6.3 · reported by WPScanMedium 6.1
- May 2, 2022Photo Gallery: Does not properly escape the $_POST['filter_tag'] parameterCVE-2022-1281 · affects up to 1.6.3 · reported by WPScan43% oddsCritical 9.8
- Mar 14, 2022Photo Gallery by 10Web: Does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated userCVE-2022-0169 · fixed in 1.6.0 · reported by WPScan75% oddsCritical 9.8
- Dec 6, 2021The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcCVE-2021-25041 · fixed in 1.5.68 · reported by WPScanMedium 6.1
- Aug 16, 2021Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Did not ensure that uploaded files are kept inside its uploads folderCVE-2021-24363 · fixed in 1.5.75 · reported by WPScan1.9% oddsMedium 4.9
- Aug 16, 2021Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Did not ensure that uploaded SVG files added to a gallery do not contain malicious contentCVE-2021-24362 · fixed in 1.5.75 · reported by WPScanMedium 6.1
- Jun 1, 2021Photo Gallery by 10Web - Mobile-Friendly Image Gallery: Did not properly sanitise the gallery titleCVE-2021-24310 · fixed in 1.5.67 · reported by WPScan1.1% oddsMedium 4.8
- May 14, 2021Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_idCVE-2021-24291 · fixed in 1.5.69 · reported by WPScan15% oddsMedium 6.1
- Mar 18, 2021Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php CVE-2021-24139 · fixed in 1.5.55 · reported by WPScan5.5% oddsCritical 9.8
- Feb 25, 2020Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress.CVE-2020-9335 · fixed in 1.5.46 · reported by MITRE1.4% oddsMedium 4.8
- Feb 8, 2020Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitraryCVE-2015-1394 · fixed in 1.2.11 · reported by MITRE2.3% oddsMedium 5.4
- Sep 8, 2019SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameCVE-2019-16119 · fixed in 1.5.35 · reported by MITRE25% oddsCritical 9.8
- Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.CVE-2019-16118 · fixed in 1.5.35 · reported by MITRE5.3% oddsMedium 6.1
- Sep 8, 2019Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.CVE-2019-16117 · fixed in 1.5.35 · reported by MITRE4.6% oddsMedium 6.1
- Aug 30, 2019The photo-gallery plugin before 1.2.42 for WordPress has CSRF.CVE-2015-9380 · fixed in 1.2.42 · reported by MITREHigh 8.8
- Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=CVE-2019-14798 · fixed in 1.5.25 · reported by MITRE4.4% oddsMedium 4.9
- Aug 9, 2019The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.CVE-2019-14797 · fixed in 1.5.23 · reported by MITRE1.3% oddsMedium 5.4
- Jul 30, 2019A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress.CVE-2019-14313 · fixed in 1.5.31 · reported by MITRE4.5% oddsCritical 9.8
- Aug 20, 2017The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() iCVE-2017-12977 · fixed in 1.3.51 · reported by MITRE1.6% oddsHigh 7.2
- Feb 2, 2015SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the CVE-2015-1393 · fixed in 1.2.11 · reported by MITRE1.7% oddsMedium 6.5
- Oct 10, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbCVE-2014-6315 · affects up to 1.1.30 · reported by MITRE2.4% oddsMedium 4.3
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.