Seo By 10Web < 1.2.7 - Cross-Site Scripting

The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id:...

Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting

Image Optimizer by 10web before 1.0.26 is susceptible to cross-site scripting via the iowdtabsactive parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can...

WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting

WordPress Photo Gallery by 10Web plugin before 1.5.69 contains multiple reflected cross-site scripting vulnerabilities via the galleryid, tag, albumid and themeid GET parameters passed to the bwgfrontenddata AJAX action, available to both unauthenticated and authenticated users. id: CVE-2021-2429...

WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting

WorsPress Spider Calendar plugin through 1.5.65 is susceptible to cross-site scripting. The plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, available to both unauthenticated and authenticated users. An attacker can injec...

Photo Gallery by 10Web < 1.6.0 - SQL Injection

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwgtagidbwgthumbnails0 parameter before using it in a SQL statement via the bwgfrontenddata AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL injection id:...

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...

CVE-2026-103896

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

CVE-2026-103896

The 10Web Booster WordPress plugin (versions up to and including 2.34.5 ) is vulnerable to unauthenticated limited file write and cache poisoning . The root cause is the OptimizerWebPageCache::get_cache_file_dir() function, which concatenates raw, unsanitized $_GET parameters into the on-disk cac...

CVE-2026-103896 10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

EUVD-2026-102671

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

CVE-2026-103896: Improper Limitation of a Pathname to a Restricted Directory

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning vulnerability

Unauthenticated Limited File Write / Cache Poisoning vulnerability discovered by Swayam Bhageria in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions = 2.34.5...

CVE-2026-18557

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18557

The Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.42 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw exists in the 'title' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web script...

EUVD-2026-101844

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18557 Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-108587

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

EUVD-2026-101824

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

CVE-2026-108587 10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

CVE-2026-108587

The 10Web Booster plugin for WordPress (versions up to and including 2.34.10 ) is vulnerable to unauthenticated arbitrary file upload via the compressCustom function. The root cause is a lack of file type validation and extension filtering on the page_id parameter. Attackers can bypass authentica...