CVE-2026-86311: WordPress Photo Gallery Plugin XSS Flaw

CVE-2026-86311 Overview

CVE-2026-86311 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress. The flaw affects all plugin versions up to and including 1.8.44. It stems from insufficient input sanitization and output escaping on shortcode attributes. Authenticated attackers with Author-level access or above can inject arbitrary web scripts that execute when any user views the affected page.

Critical Impact
Authenticated contributors with Author-level permissions can persistently inject JavaScript that runs in the browsers of site visitors and administrators, enabling session theft, forced administrative actions, and content defacement.

Affected Products

Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress
All versions up to and including 1.8.44
WordPress installations where Author-level or higher accounts exist

Discovery Timeline

2026-09-17 - CVE-2026-86311 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-86311

Vulnerability Analysis

The vulnerability resides in how the Photo Gallery plugin processes shortcode attributes. WordPress shortcodes accept user-supplied attributes that the plugin renders into HTML output. In affected versions, the plugin fails to sanitize these attributes on input and does not escape them on output. Attacker-controlled values reach the DOM as executable markup rather than inert text.

Because the payload is stored in post or page content, execution occurs every time a visitor loads the page. This turns a single injection into a persistent client-side compromise vector affecting any authenticated or unauthenticated visitor who views the injected page.

Root Cause

The root cause is missing input validation and missing output escaping on shortcode attribute values. WordPress provides helper functions such as sanitize_text_field(), esc_attr(), and esc_html() for this purpose. The plugin did not apply appropriate escaping in the shortcode rendering path prior to version 1.8.45. The upstream fix was published in the WordPress Plugin Changeset.

Attack Vector

Exploitation requires an authenticated account with Author-level privileges or higher. The attacker creates or edits a post containing a Photo Gallery shortcode and inserts a malicious payload into one of the accepted attributes. When the post is published and rendered, the injected script executes in the browser context of every viewer, including site administrators. See the Wordfence Vulnerability Report for additional attribute-level detail.

Detection Methods for CVE-2026-86311

Indicators of Compromise

Post or page content containing Photo Gallery shortcodes with attribute values that include <script>, onerror=, onload=, or javascript: sequences
Unexpected outbound requests from visitor browsers to attacker-controlled domains after visiting pages using the plugin
New administrative users or modified user roles created shortly after Author-level account activity
Author-level accounts editing pages outside their normal content scope

Detection Strategies

Audit the wp_posts table for shortcode blocks associated with the Photo Gallery plugin containing suspicious attribute payloads
Review WordPress audit logs for post edits made by Author-level accounts that add or modify gallery shortcodes
Deploy Content Security Policy (CSP) reporting to surface inline script violations originating from plugin-rendered pages
Compare the installed plugin version against 1.8.45 or later across all sites in the estate

Monitoring Recommendations

Alert on creation or modification of Author-level and Editor-level user accounts
Monitor web server logs for anomalous request patterns to pages containing Photo Gallery shortcodes
Track browser-side telemetry for script executions originating from WordPress-hosted content
Baseline expected plugin versions and alert on drift from the patched build

How to Mitigate CVE-2026-86311

Immediate Actions Required

Update the Photo Gallery by 10Web plugin to version 1.8.45 or later on every WordPress instance
Audit all existing posts and pages that use Photo Gallery shortcodes for injected script content
Review the list of Author-level and higher accounts and remove any that are unnecessary or stale
Rotate session tokens and administrative credentials if injection is confirmed

Patch Information

The vendor addressed the vulnerability in the plugin release following commit 3687152. Site operators should upgrade to the patched build published on WordPress.org. Refer to the WordPress Plugin Changeset for the exact code change applied to the shortcode handler.

Workarounds

Restrict Author-level and higher role assignments to trusted users only until patching is complete
Deploy a Web Application Firewall (WAF) rule that blocks shortcode attribute values containing HTML tags or JavaScript event handlers
Enforce a strict Content Security Policy that disallows inline scripts on pages rendering Photo Gallery content
Temporarily deactivate the plugin on high-value sites until the update is applied

bash

# Configuration example
wp plugin update photo-gallery --version=1.8.45
wp plugin list --name=photo-gallery --fields=name,status,version