CVE-2026-92974: Photo Gallery by 10Web XSS Vulnerability

CVE-2026-92974 Overview

CVE-2026-92974 is a reflected Cross-Site Scripting (XSS) vulnerability in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress. The flaw affects all versions up to and including 1.8.46. It stems from insufficient input sanitization and output escaping on the thumb_url parameter processed by the editimage_bwg AJAX action. Unauthenticated attackers can craft a URL that injects arbitrary JavaScript into a response rendered in an administrator's browser. Successful exploitation requires an authenticated victim holding the manage_options capability to click a crafted link [CWE-79].

Critical Impact
An attacker can execute arbitrary JavaScript in the context of a WordPress administrator, enabling account takeover, settings modification, or injection of persistent backdoors.

Affected Products

Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress
All plugin versions through 1.8.46
WordPress sites exposing the editimage_bwg AJAX action to administrators

Discovery Timeline

2026-10-03 - CVE-2026-92974 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-92974

Vulnerability Analysis

The vulnerability resides in the plugin's editimage_bwg AJAX handler, reachable through the standard WordPress admin-ajax.php endpoint. The thumb_url GET parameter is reflected into the rendered edit-image view without adequate sanitization or output escaping. An attacker who supplies JavaScript inside thumb_url causes that script to execute in the victim's browser session when the page is rendered.

The handler enforces a capability check requiring manage_options, limiting the victim pool to administrators. However, the handler does not perform nonce verification. Because no CSRF token is required, the attack payload can be delivered through a simple crafted link rather than a form POST. Combined with user interaction, this produces a scoped XSS that pivots administrator privileges into arbitrary script execution.

Successful exploitation can be chained to create new administrator accounts, modify site options, exfiltrate session cookies, or stage further payloads such as plugin or theme file edits leading to persistent code execution on the server.

Root Cause

The root cause is a failure to sanitize and escape the thumb_url request parameter before echoing it into HTML output in admin/views/Editimage.php. The plugin treats attacker-controlled input as trusted markup. The absence of nonce validation on editimage_bwg additionally removes a layer of protection that would otherwise prevent cross-origin request abuse.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a URL to the target site's admin-ajax.php with action=editimage_bwg and a malicious thumb_url value. The attacker delivers this URL to an administrator via phishing, a forum post, or any clickable context. When the administrator follows the link while authenticated, the reflected payload executes in the WordPress admin origin.

No verified public exploit code is available. For technical details, see the Wordfence Vulnerability Analysis and the vulnerable source in WordPress Photo Gallery Edit Image.

Detection Methods for CVE-2026-92974

Indicators of Compromise

Requests to /wp-admin/admin-ajax.php with action=editimage_bwg and a thumb_url parameter containing HTML tags, URL-encoded <script>, javascript: schemes, or event handlers such as onerror=.
Unexpected creation of WordPress administrator accounts or changes to siteurl, home, or active plugin options shortly after an administrator session.
Outbound requests from administrator browsers to unfamiliar domains immediately after visiting an external link.

Detection Strategies

Inspect web server and WordPress access logs for GET requests referencing editimage_bwg with suspicious thumb_url content, especially from unauthenticated sessions.
Deploy web application firewall rules that flag reflected script patterns and unusual characters in query parameters bound to admin-ajax.php actions.
Correlate administrator authentication events with subsequent high-privilege actions originating from the same session cookie but with anomalous Referer headers.

Monitoring Recommendations

Alert on new administrator role assignments, plugin or theme file edits, and option changes performed through the REST API or admin-ajax.php.
Monitor browser telemetry for script execution within the /wp-admin/ origin triggered by cross-site navigation.
Track installed WordPress plugin versions across the fleet and alert when photo-gallery is at or below 1.8.46.

How to Mitigate CVE-2026-92974

Immediate Actions Required

Update the Photo Gallery by 10Web plugin to a version later than 1.8.46 as published in the vendor changeset.
Audit administrator accounts, scheduled tasks, and plugin or theme files for unauthorized modifications.
Rotate administrator credentials and invalidate active sessions if compromise is suspected.

Patch Information

The vendor addressed the issue in the plugin's trunk. Review the fix in the WordPress Photo Gallery Changeset and apply the latest release through the WordPress plugin updater or via WP-CLI.

Workarounds

Deactivate the Photo Gallery by 10Web plugin until the patched version is installed.
Restrict access to /wp-admin/ by source IP where feasible to limit exposure of the vulnerable AJAX endpoint.
Train administrators to avoid clicking unsolicited links to the WordPress admin interface and to use separate browser profiles for administrative tasks.

bash

# Configuration example: update the plugin using WP-CLI
wp plugin update photo-gallery
wp plugin list --name=photo-gallery --fields=name,status,version