--- title: "10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/10web/photo-gallery-by-10web-mobile-friendly-image-gallery type: product description: "10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery has 15 published CVEs, 0 in CISA KEV and 2 with public exploits." updated: 2026-10-15 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities Vendor: [10Web](https://radicalnotion.ai/vendor/10web) - **Published CVEs:** 15 - **In CISA KEV:** 0 - **With a public exploit:** 2 - **With a patch:** 15 - **Average CVSS:** 6.3 - **First CVE:** 2021-06-01 - **Latest CVE:** 2026-10-15 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 1 | | High | 1 | | Medium | 13 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 9 | | [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 3 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | | [CWE-35](https://radicalnotion.ai/cwe/cwe-35) | Path Traversal: '.../...//' | 1 | | [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2021 | 1 | | 2022 | 0 | | 2023 | 0 | | 2024 | 6 | | 2025 | 1 | | 2026 | 7 | ## Affected versions (top 13 of 14) | Version | Kind | CVEs | | --- | --- | --- | | \<= 1.8.23 | range | 2 | | \<= 1.8.44 | range | 2 | | \<= 1.8.18 | range | 1 | | \<= 1.8.19 | range | 1 | | \<= 1.8.21 | range | 1 | | \<= 1.8.30 | range | 1 | | \<= 1.8.34 | range | 1 | | \<= 1.8.36 | range | 1 | | \<= 1.8.40 | range | 1 | | \<= 1.8.41 | range | 1 | | \<= 1.8.42 | range | 1 | | \<= 1.8.46 | range | 1 | | 1.5.67 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-18557 | Photo Gallery by 10Web \<= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter | medium | 6.1 | No | No | Yes | | CVE-2026-92974 | Photo Gallery by 10Web \<= 1.8.46 - Reflected Cross-Site Scripting via 'thumb\_url' Parameter | medium | 6.1 | No | No | Yes | | CVE-2026-85652 | Photo Gallery by 10Web \<= 1.8.44 - Authenticated (Author+) SQL Injection via 'album\_id' Shortcode Attribute | medium | 6.5 | No | No | Yes | | CVE-2026-86311 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | medium | 6.4 | No | No | Yes | | CVE-2026-9829 | Photo Gallery by 10Web \<= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact\_album\_order\_by' Shortcode Parameter | medium | 6.5 | No | No | Yes | | CVE-2026-7048 | Photo Gallery by 10Web \<= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order\_by' Shortcode Attribute | medium | 6.5 | No | No | Yes | | CVE-2026-1036 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion | medium | 5.3 | No | No | Yes | | CVE-2025-2269 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.34 Reflected Cross-Site Scripting via 'image\_id' Parameter | medium | 6.1 | No | No | Yes | | CVE-2024-9878 | Photo Gallery by 10Web \<= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting | medium | 4.8 | No | Yes | Yes | | CVE-2024-5481 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc\_dir Function | high | 8.8 | No | No | Yes | | CVE-2024-5426 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG | medium | 6.4 | No | No | Yes | | CVE-2024-2296 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG | medium | 5.5 | No | No | Yes | | CVE-2024-0221 | Photo Gallery by 10Web - Mobile-Friendly Image Gallery \<= 1.8.19 - Directory Traversal to Arbitrary File Rename | critical | 9.1 | No | No | Yes | | CVE-2023-6924 | Photo Gallery by 10Web \<= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget | medium | 4.8 | No | No | Yes | | CVE-2021-24310 | Photo Gallery \< 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title | medium | 4.8 | No | Yes | Yes | ## Frequently asked questions ### How many CVEs does 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery have? 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery has 15 published CVE records since 2021. ### How many 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery CVEs are in CISA KEV? None of 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities? Yes — 2 of 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery's CVEs have a known public exploit. ### Which versions of 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery are affected? 14 distinct 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery CVEs? 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-35 (Path Traversal: '.../...//'). ### How many critical 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerabilities are there? 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery has 1 critical and 1 high-severity CVEs. ### What is the average severity of 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery CVEs? The average CVSS base score across 10Web Photo Gallery by 10Web – Mobile-Friendly Image Gallery's scored CVEs is 6.3. ## Other products from this vendor - [photo gallery](https://radicalnotion.ai/vendor/10web/photo-gallery) (49 CVEs) - [Form Maker](https://radicalnotion.ai/vendor/10web/form-maker) (26 CVEs) - [Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder](https://radicalnotion.ai/vendor/10web/form-maker-by-10web-mobile-friendly-drag-and-drop-contact-form-builder) (20 CVEs) - [slider](https://radicalnotion.ai/vendor/10web/slider) (12 CVEs) - [Photo Gallery by 10Web](https://radicalnotion.ai/vendor/10web/photo-gallery-by-10web) (6 CVEs) - [10Web Booster – Website speed optimization, Cache & Page Speed optimizer](https://radicalnotion.ai/vendor/10web/10web-booster-website-speed-optimization-cache-and-page-speed-optimizer) (5 CVEs) - [PhotoGallery](https://radicalnotion.ai/vendor/10web/photogallery) (5 CVEs) - [Slider by 10Web](https://radicalnotion.ai/vendor/10web/slider-by-10web) (5 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/10web/photo-gallery-by-10web-mobile-friendly-image-gallery). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.