CVE-2026-12865

The Photo Gallery by 10Web WordPress plugin (versions before 1.8.44 ) is vulnerable to Reflected XSS because it fails to escape two request parameters before reflecting them into input-attribute values on its admin pages. This occurs on the Shortcode page and the Galleries/Albums list page . An u...