CVE-2026-12865: Photo Gallery by 10Web XSS Vulnerability

CVE-2026-12865 Overview

CVE-2026-12865 is a reflected cross-site scripting (XSS) vulnerability in the Photo Gallery by 10Web WordPress plugin before version 1.8.44. The plugin fails to escape two request parameters before reflecting them into input-attribute values on its admin pages. One sink resides on the Shortcode page, and the other on the Galleries/Albums list page. An unauthenticated attacker can craft a link that, when opened by a logged-in administrator or contributor, executes arbitrary JavaScript in the victim's authenticated session using an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries or albums.

Critical Impact
Arbitrary JavaScript execution in an authenticated administrator's browser session, enabling account takeover, plugin configuration changes, and content injection.

Affected Products

Photo Gallery by 10Web WordPress plugin versions prior to 1.8.44
WordPress sites using the Shortcode admin page of the affected plugin
WordPress sites with more than 20 galleries or albums using the Galleries/Albums list page

Discovery Timeline

2026-09-02 - CVE-2026-12865 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-12865

Vulnerability Analysis

The flaw is a reflected XSS issue classified under CWE-79. The plugin echoes two attacker-controlled request parameters directly into HTML input-attribute contexts on admin pages without proper output encoding. Because the payload lands inside an attribute value, an attacker can break out of the attribute and inject an event handler such as onfocus that fires automatically when the browser focuses the element.

The first sink is reachable by users with contributor-level privileges or higher on the Shortcode admin page. The second sink is limited to administrators viewing the Galleries/Albums list page, and it only renders when the site contains more than 20 galleries or albums. This threshold is common on populated production installs.

Root Cause

The root cause is missing output escaping when reflecting HTTP request parameters into value attributes of <input> elements in the plugin's admin views. WordPress provides esc_attr() for this exact context, but the affected code paths reflect user input without applying it.

Attack Vector

The attack requires user interaction. An unauthenticated attacker crafts a URL containing a malicious payload in one of the vulnerable parameters and delivers it via phishing, comment fields, or third-party sites. When a logged-in administrator or contributor clicks the link, the injected onfocus handler auto-fires and executes attacker-controlled JavaScript within the authenticated WordPress admin origin. Payloads can create new administrator accounts, exfiltrate nonces, or modify plugin configuration.

See the WPScan Vulnerability Report for technical details on the vulnerable parameters and sinks.

Detection Methods for CVE-2026-12865

Indicators of Compromise

Unexpected administrator or editor accounts created after an admin session interacted with an external link
Web server access logs showing requests to Photo Gallery admin pages containing HTML entities, quote characters, or onfocus, onerror, or <script> fragments in query parameters
Modifications to plugin options, shortcodes, or gallery entries with no corresponding admin activity
Outbound requests from admin browsers to unfamiliar domains shortly after clicking gallery-related URLs

Detection Strategies

Inspect HTTP request logs for the Photo Gallery admin endpoints and flag parameter values containing onfocus=, autofocus, ", >, or URL-encoded equivalents
Deploy Web Application Firewall (WAF) rules that block reflected XSS payloads targeting WordPress wp-admin paths associated with the plugin
Correlate WordPress audit logs with browser referrer data to identify admin sessions that followed external links before performing sensitive actions

Monitoring Recommendations

Enable a WordPress audit-logging plugin to record user creation, role changes, and plugin option updates
Alert on any creation of administrator-role users outside of change-controlled workflows
Monitor the installed plugin inventory to confirm Photo Gallery by 10Web is running version 1.8.44 or later across all WordPress instances

How to Mitigate CVE-2026-12865

Immediate Actions Required

Update the Photo Gallery by 10Web plugin to version 1.8.44 or later on every affected WordPress site
Review recent administrator activity for unauthorized user creation or configuration changes
Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected
Restrict contributor and administrator accounts to trusted personnel and enforce multi-factor authentication

Patch Information

Upgrade the Photo Gallery by 10Web WordPress plugin to version 1.8.44 or later. The fixed release adds proper output escaping for the two reflected parameters on the Shortcode and Galleries/Albums admin pages. Reference the WPScan Vulnerability Report for advisory details.

Workarounds

Deploy a WAF rule that blocks requests to the plugin's admin pages containing common XSS tokens such as onfocus, onerror, and <script> in query parameters
Restrict access to wp-admin by IP allowlist while a patch rollout is in progress
Temporarily deactivate the Photo Gallery by 10Web plugin on sites that cannot be updated immediately
Train administrators and contributors to avoid clicking untrusted links while authenticated to WordPress

bash

# Example WP-CLI command to update the plugin to a fixed version
wp plugin update photo-gallery --version=1.8.44