CVE-2022-0169

The CVE concerns the WordPress plugin Photo Gallery by 10Web (versions before 1.6.0). The vulnerability is an SQL injection in admin-ajax.php via bwg_tag_id_bwg_thumbnails_0 in the bwg_frontend_data action, exploitable by unauthenticated users. Root cause: lack of validation/escaping of the bwg_t...

CVE-2015-1394

The CVE-2015-1394 entry corresponds to multiple XSS vulnerabilities in the WordPress plugin Photo Gallery (before 1.2.11). The vulnerability allows remote authenticated users to inject arbitrary JavaScript/HTML via parameters (sort_by, sort_order, items_view, dir, clipboard_task, clipboard_files,...

CVE-2019-16119

The CVE concerns the WordPress Photo Gallery by 10Web plugin. A SQL injection vulnerability exists in versions prior to 1.5.35, exploitable via the album_id parameter in admin/controllers/Albumsgalleries.php, allowing potential unauthorized database access or modification. Public writeups rate th...

CVE-2019-16118

CVE-2019-16118 affects the WordPress Photo Gallery (10Web Photo Gallery) plugin prior to 1.5.35. The issue is a Cross-Site Scripting (XSS) vulnerability exposed via admin/controllers/Options.php, caused by unvalidated/unescaped data. Impact per sources: attacker could execute script in victim’s b...

CVE-2019-16117

CVE-2019-16117 affects the WordPress plugin Photo Gallery by 10Web, with XSS in the gallery title parsed via admin/models/Galleries.php. Affected versions are prior to 1.5.35. Root cause: insufficient sanitization/escaping of gallery title, enabling stored XSS that can trigger when listing or vie...

CVE-2021-31693

The WordPress plugin WordPress Photo Gallery by 10Web (before version 1.5.69) is affected by CVE-2021-31693 and related CVEs. Concrete details from connected documents show multiple reflected cross-site scripting vulnerabilities via GET parameters gallery_id, tag, album_id, and theme_id passed to...

CVE-2020-9335

CVE-2020-9335 affects the WordPress Photo Gallery by 10Web plugin (versions prior to 1.5.46). The connected sources confirm multiple stored XSS vulnerabilities that allow an authenticated admin to inject arbitrary JavaScript viewed by other users, due to insufficient input validation/sanitization...

CVE-2021-24139

CVE-2021-24139 affects the WordPress plugin 10Web Photo Gallery; versions prior to 1.5.55 contain an SQL injection in frontend/models/model.php via the bwg_search_x parameter. The issue is confirmed by connected data (Nuclei template: 10Web Photo Gallery

CVE-2019-14313

The CVE-2019-14313 issue affects the WordPress Photo Gallery (10Web) plugin versions prior to 1.5.31. The vulnerability is a SQL injection in filemanager/model.php that could allow a remote attacker to execute arbitrary SQL commands on the affected site. The NVD and Red Hat entries corroborate a ...

CVE-2021-24291

WordPress Photo Gallery by 10Web (plugin before 1.5.69) contains reflected XSS flaws in bwg_frontend_data, exploitable by unauthenticated or authenticated users via GET parameters such as gallery_id, tag, album_id and theme_id. The XSS can execute script in the victim’s browser (impact: script ex...

CVE-2022-1281

The CVE-2022-1281 issue affects the WordPress Photo Gallery plugin up to version 1.6.3, where the $_POST['filter_tag'] parameter is not properly escaped before being appended to an SQL query, enabling SQL Injection attacks. Multiple connected advisories confirm the root cause and impact as unauth...

CVE-2022-1394

CVE-2022-1394 concerns the WordPress plugin Photo Gallery by 10Web. The affected software is the Photo Gallery plugin for WordPress, with vulnerable versions prior to 1.6.4. The root cause is improper validation and escaping of certain settings, which can allow Cross-Site Scripting (XSS) by high-...

CVE-2022-1282

CVE-2022-1282 affects the WordPress plugin Photo Gallery by 10Web (before 1.6.3). The issue is a reflected XSS: $_GET['image_url'] is not sanitized and is echoed back in the editimage_bwg AJAX action. This can allow script execution via a crafted image_url payload. Remediation is upgrading to ver...

CVE-2023-6924

CVE-2023-6924 affects the Photo Gallery by 10Web WordPress plugin. It is a Stored XSS via widgets caused by insufficient input sanitization and output escaping on user-supplied attributes, playable by authenticated admins, above-admins, or contributors with a page builder plugin. Versions up to a...

CVE-2024-29809

CVE-2024-29809 is a reflected XSS in the Photo Gallery WordPress plugin (referenced by RH CVE) where the image_url parameter in the admin-ajax.php editimage_bwg action is echoed into JavaScript in the response. This requires an authenticated user with access to the component. The Red Hat entry re...

CVE-2024-0221

CVE-2024-0221 affects the WordPress plugin Photo Gallery by 10Web – Mobile-Friendly Image Gallery (

CVE-2021-24363

CVE-2021-24363 affects the WordPress plugin Photo Gallery by 10Web – Mobile-Friendly Image Gallery, prior to version 1.5.75. The vulnerability arises from improper enforcement that uploaded files stay within the plugin’s uploads folder, enabling a path traversal that could allow high-privilege us...

CVE-2021-46889

The CVE-2021-46889 entry concerns the WordPress Photo Gallery by 10Web plugin prior to version 1.5.69, which is vulnerable to cross-site scripting via the theme_id parameter in the bwg_frontend_data AJAX action. The linked technical detail (CVE-2021-24291) confirms multiple reflected XSS vectors ...

CVE-2024-2296

CVE-2024-2296 affects Photo Gallery by 10Web – Mobile-Friendly Image Gallery (WordPress). It is a Stored XSS via SVG file uploads in version up to 1.8.21, caused by insufficient input sanitization and output escaping. Attack requires authenticated admin privileges and affects multisite installati...

CVE-2014-9312

CVE-2014-9312 : WordPress Photo Gallery plugin (version 1.2.5) contains an Unrestricted File Upload vulnerability. The root cause is UploadHandler.php allowing access to file uploads without proper verification/sanitization, enabling an attacker with a registered user account to upload arbitrary ...

CVE-2019-14798

The CVE-2019-14798 case concerns the WordPress plugin Photo Gallery by 10Web (before 1.5.25). Affected component: wp-admin/admin-ajax.php handling of action=shortcode_bwg with the tagtext parameter. Root cause: Authenticated Local File Inclusion via directory traversal, enabling access to files o...

CVE-2024-29808

CVE-2024-29808 affects the Photo Gallery WordPress plugin family (e.g., 10Web Photo Gallery). It describes a reflected XSS in the image_id parameter of the admin-ajax.php editimage_bwg AJAX action, where the image_id value is echoed within existing JavaScript in the response, enabling arbitrary s...

CVE-2024-29832

CVE-2024-29832 affects the Photo Gallery WordPress plugin. The vulnerability is a reflected XSS in the current_url parameter of the admin-ajax.php GalleryBox AJAX call, where the current_url value is embedded into existing JavaScript in the response, allowing arbitrary JavaScript execution. Explo...

CVE-2024-32583

CVE-2024-32583 concerns WordPress Photo Gallery by 10Web plugin. A Reflected Cross-Site Scripting (XSS) vulnerability exists in versions up to and including 1.8.21, allowing unauthenticated attackers to inject scripts via input that is reflected in page generation. The issue affects the plugin’s ...

CVE-2024-33586

CVE-2024-33586 is a Missing Authorization vulnerability affecting the WordPress plugin Photo Gallery by 10Web (versions up to and including 1.8.20). The connected documents confirm an unauthorized action could be performed due to insufficient access checks, constituting a Missing Authorization is...

CVE-2017-12977

CVE-2017-12977 affects the Web-Dorado Photo Gallery by WD – Responsive Photo Gallery WordPress plugin prior to 1.3.51. The vulnerability is a SQL injection in bwg_edit_tag() (photo-gallery.php) and edit_tag() (admin/controllers/BWGControllerTags_bwg.php) that is exploitable by administrators via ...

CVE-2022-4058

CVE-2022-4058 affects the WordPress plugin Photo Gallery by 10Web, versions before 1.8.3. The root cause is failure to validate/escape certain parameters before outputting them in JavaScript on another page, enabling a Stored XSS when a logged-in admin visits a crafted URL. The CVSS base score is...

CVE-2024-29810

CVE-2024-29810 details (mode C) : Affected software is the 10Web Photo Gallery WordPress plugin. The vulnerability is a reflected Cross-Site Scripting via the thumb_url parameter in the AJAX response for editimage_bwg in admin-ajax.php. The flaw allows arbitrary JavaScript to be inserted and exec...

CVE-2015-9380

The CVE-2015-9380 entry corresponds to a CSRF vulnerability in the WordPress plugin Photo Gallery (versions before 1.2.42). The issue is described as a cross-site request forgery in the photo-gallery plugin, enabling unauthorized actions without authentication. Multiple sources (NVD description, ...

CVE-2024-29833

CVE-2024-29833 affects WordPress Photo Gallery plugin

CVE-2019-14797

The CVE-2019-14797 entry concerns the WordPress plugin Photo Gallery by 10Web (WordPress, prior to version 1.5.23). The vulnerability is an authenticated stored XSS in the plugin, as stated across multiple connected sources. In practical terms, an authenticated attacker could inject malicious scr...

CVE-2021-25041

The CVE-2021-25041 entry concerns the Photo Gallery by 10Web WordPress plugin and its vulnerability to Reflected Cross-Site Scripting (XSS) in WordPress. Affected component is the bwg_frontend_data AJAX action, with exploitation via GET parameters bwg_album_breadcrumb_0 and shortcode_id passed to...

CVE-2021-24310

Affected product: Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin, vulnerable in versions before 1.5.67. Root cause: improper sanitisation of the gallery title, stemming from an incomplete fix of CVE-2019-16117. Impact: authenticated users with high privileges can inject X...

CVE-2023-1427

The CVE-2023-1427 entry describes a path traversal vulnerability in the WordPress plugin Photo Gallery by 10Web, affecting versions prior to 1.8.15. The root cause is that uploaded files were not consistently kept within the plugin’s intended uploads directory, allowing high-privilege users to pl...

CVE-2024-5426

CVE-2024-5426 affects the Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin. It allows Stored Cross-Site Scripting via the svg parameter in all versions up to and including 1.8.23 due to insufficient input sanitization and output escaping. Impact: authenticated attackers can...

CVE-2015-1393

The CVE-2015-1393 entry concerns the Photo Gallery WordPress plugin (before 1.2.11). The vulnerability is a SQL injection in the asc_or_desc parameter of a create gallery request processed via galleries_bwg on wp-admin/admin.php, exploitable by remote authenticated users. The affected component i...

CVE-2024-35628

CVE-2024-35628 affects the WordPress plugin Photo Gallery by 10Web (versions up to 1.8.25). The issue is a Missing Authorization/Broken Access Control vulnerability that could allow unauthorized actions. Patch 1.8.26 fixes the flaw. Exploit details are not provided in the supplied documents; no a...

CVE-2024-5481

Affected software: Photo Gallery by 10Web – Mobile-Friendly Image Gallery (WordPress). CVE-2024-5481 affects all versions up to 1.8.23. Root cause: Path Traversal via esc_dir leading to copying arbitrary files and deleting arbitrary directories (including WordPress root). By default exploitable b...

CVE-2015-1055

The CVE-2015-1055 vulnerability affects the WordPress Photo Gallery plugin (version 1.2.7 and earlier) used with WordPress. It allows remote attackers to perform a blind SQL injection via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php, potentially exposing or altering da...

CVE-2025-0613

The CVE-2025-0613 entry affects the WordPress plugin Photo Gallery by 10Web (prior to version 1.8.34). The vulnerability arises from insufficient sanitization and escaping of comments added to images by unauthenticated users, leading to an Unauthenticated Stored XSS when those comments are displa...

CVE-2024-44043

CVE-2024-44043 is a stored XSS in WordPress plugin Photo Gallery by 10Web up to version 1.8.27 . The issue arises from improper input handling during web page generation. Patch data from Patchstack indicates the fix is in version 1.8.28 ; the vulnerability has a low patch priority and is consider...

CVE-2021-24362

The CVE-2021-24362 entry concerns the WordPress plugin “Photo Gallery by 10Web – Mobile-Friendly Image Gallery” (older builds). Affected versions prior to 1.5.75 fail to sanitize uploaded SVG content, allowing a user who can add images to a gallery to upload an SVG containing JavaScript. When the...

CVE-2024-5968

The CVE concerns the WordPress plugin Photo Gallery by 10Web. Vulnerable before version 1.8.28, the plugin does not properly sanitize and escape certain Gallery settings, enabling Stored XSS by high-privilege users (e.g., Administrators) even when unfiltered_html is disallowed (such as in multisi...

CVE-2024-10704

The CVE-2024-10704 entry concerns the WordPress plugin Photo Gallery by 10Web (prior to version 1.8.31). Root cause: unsanitized/unescaped settings allow Admin+ users to perform Stored XSS, potentially even when unfiltered_html is disallowed (e.g., in multisite). Impact: Stored XSS could affect s...

CVE-2015-2324

CVE-2015-2324 is a Cross-Site Scripting (XSS) vulnerability in the WordPress Photo Gallery plugin’s filemanager, affecting versions before 1.2.13. The issue permits remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors. Exploitation details...

CVE-2023-33995

CVE-2023-33995 affects the WordPress plugin Photo Gallery by 10Web (versions ≤ 1.8.15). The issue is a missing authorization check / broken access control in the plugin, enabling access control weaknesses. A fix is available: update to version 1.8.16 . The CVSS base score is 4.3 (Medium). If need...

CVE-2024-13124

CVE-2024-13124 affects the Photo Gallery by 10Web WordPress plugin prior to 1.8.33. The issue is stored XSS arising from incomplete sanitization/escaping of plugin settings, potentially allowing admin-level users to perform stored XSS even when unfiltered_html is disallowed (e.g., multisite). Aff...

CVE-2024-9878

CVE-2024-9878 is a Stored XSS in the WordPress plugin “Photo Gallery by 10Web – Mobile-Friendly Image Gallery” up to version 1.8.30, exploitable by authenticated admins with access to admin settings. The vulnerability arises from insufficient input sanitization and output escaping, enabling injec...

CVE-2024-8670

CVE-2024-8670 affects the Photo Gallery by 10Web WordPress plugin prior to 1.8.29. The vulnerability stems from incomplete sanitization/escaping of plugin settings, enabling Stored XSS by high-privilege admins even when unfiltered_html is disallowed (e.g., multisite). Exploitation context: authen...