CVE-2026-110072 Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attribute

The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to...

CVE-2026-110072

The Photo Gallery by 10Web WordPress plugin (versions before 1.8.49 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape a shortcode attribute used to set a gallery watermark image before it is rendered into an HTML image attribute, combined with the decodi...