---
title: "10Web photo gallery vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/10web/photo-gallery
type: product
description: "10Web photo gallery has 49 published CVEs, 0 in CISA KEV and 32 with public exploits."
updated: 2025-05-15
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# 10Web photo gallery vulnerabilities

Vendor: [10Web](https://radicalnotion.ai/vendor/10web)

- **Published CVEs:** 49
- **In CISA KEV:** 0
- **With a public exploit:** 32
- **With a patch:** 49
- **Average CVSS:** 6.2
- **First CVE:** 2015-01-16
- **Latest CVE:** 2025-05-15

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 6 |
| High | 6 |
| Medium | 36 |
| Low | 1 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 30 |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 8 |
| [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 3 |
| [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 3 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 1 |
| [CWE-35](https://radicalnotion.ai/cwe/cwe-35) | Path Traversal: '.../...//' | 1 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2015 | 2 |
| 2016 | 0 |
| 2017 | 2 |
| 2018 | 1 |
| 2019 | 7 |
| 2020 | 2 |
| 2021 | 6 |
| 2022 | 6 |
| 2023 | 2 |
| 2024 | 18 |
| 2025 | 3 |

## Affected versions (top 24 of 68)

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 1.8.22 | range | 7 |
| 1.0.1 \<= v \<= 1.8.21 | range | 5 |
| \< 1.5.35 | range | 3 |
| \< 1.5.75 | range | 2 |
| \< 1.8.24 | range | 2 |
| \< 1.8.28 | range | 2 |
| \< 1.8.31 | range | 2 |
| \< 1.2.11 | range | 1 |
| \< 1.2.13 | range | 1 |
| \< 1.2.42 | range | 1 |
| \< 1.5.23 | range | 1 |
| \< 1.5.25 | range | 1 |
| 1.8.22 | patched | 7 |
| 1.5.35 | patched | 3 |
| 1.5.75 | patched | 2 |
| 1.8.24 | patched | 2 |
| 1.8.28 | patched | 2 |
| 1.8.31 | patched | 2 |
| 1.2.11 | patched | 1 |
| 1.2.13 | patched | 1 |
| 1.2.42 | patched | 1 |
| 1.5.23 | patched | 1 |
| 1.5.25 | patched | 1 |
| 1.5.31 | patched | 1 |

## CVEs (first 30 of 49, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2024-8670 | Photo Gallery by 10Web \< 1.8.29 - Admin+ Stored XSS | medium | 4.8 | No | Yes | Yes |
| CVE-2025-0613 | Photo Gallery \< 1.8.34 - Unauthenticated Stored XSS | medium | 6.1 | No | Yes | Yes |
| CVE-2024-13124 | Photo Gallery by 10Web \< 1.8.33 - Admin+ Stored XSS | low | 3.5 | No | Yes | Yes |
| CVE-2023-33995 | WordPress Photo Gallery by 10Web plugin \<= 1.8.15 - Broken Access Control vulnerability | medium | 4.3 | No | No | Yes |
| CVE-2024-10704 | Photo Gallery by 10Web \< 1.8.31 - Admin+ Stored XSS | medium | 4.8 | No | Yes | Yes |
| CVE-2024-9878 | Photo Gallery by 10Web \<= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting | medium | 4.8 | No | Yes | Yes |
| CVE-2024-5968 | Photo Gallery by 10Web \<= 1.8.27 - Admin+ Stored XSS | medium | 4.8 | No | Yes | Yes |
| CVE-2024-44043 | WordPress Photo Gallery by 10Web plugin \<= 1.8.27 - Cross Site Scripting (XSS) vulnerability | medium | 5.9 | No | No | Yes |
| CVE-2024-35628 | WordPress Photo Gallery by 10Web plugin \<= 1.8.25 - Broken Access Control vulnerability | medium | 4.3 | No | No | Yes |
| CVE-2024-5481 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc\_dir Function | high | 8.8 | No | No | Yes |
| CVE-2024-5426 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG | medium | 6.4 | No | No | Yes |
| CVE-2024-33586 | WordPress Photo Gallery by 10Web plugin \<= 1.8.20 - Broken Access Control vulnerability | medium | 5.3 | No | No | Yes |
| CVE-2024-32583 | WordPress Photo Gallery by 10Web plugin \<= 1.8.21 - Reflected Cross Site Scripting (XSS) vulnerability | high | 7.1 | No | No | Yes |
| CVE-2024-2296 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG | medium | 5.5 | No | No | Yes |
| CVE-2024-29833 | WordPress Photo Gallery Plugin \<= 1.8.21 Stored Cross Site Scripting in UploadHandler | medium | 5.4 | No | Yes | Yes |
| CVE-2024-29810 | WordPress Photo Gallery Plugin \<= 1.8.21 Reflected Cross Site Scripting in editimage\_bwg thumb\_url | medium | 5.4 | No | Yes | Yes |
| CVE-2024-29809 | WordPress Photo Gallery Plugin \<= 1.8.21 Reflected Cross Site Scripting in editimage\_bwg image\_url | medium | 5.4 | No | Yes | Yes |
| CVE-2024-29808 | WordPress Photo Gallery Plugin \<= 1.8.21 Reflected Cross Site Scripting in editimage\_bwg image\_id | medium | 5.4 | No | Yes | Yes |
| CVE-2024-29832 | WordPress Photo Gallery Plugin \<= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current\_url | medium | 6.1 | No | Yes | Yes |
| CVE-2024-0221 | Photo Gallery by 10Web - Mobile-Friendly Image Gallery \<= 1.8.19 - Directory Traversal to Arbitrary File Rename | critical | 9.1 | No | No | Yes |
| CVE-2023-6924 | Photo Gallery by 10Web \<= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget | medium | 4.8 | No | No | Yes |
| CVE-2021-46889 | - | medium | 6.1 | No | Yes | Yes |
| CVE-2023-1427 | Photo Gallery by 10Web \< 1.8.15 - Admin+ Path Traversal | medium | 4.9 | No | Yes | Yes |
| CVE-2022-4058 | Photo Gallery \< 1.8.3 - Stored XSS via CSRF | medium | 5.4 | No | Yes | Yes |
| CVE-2021-31693 | - | medium | 6.1 | No | Yes | Yes |
| CVE-2022-1394 | Photo Gallery \< 1.6.4 - Admin+ Stored Cross-Site Scripting | medium | 4.8 | No | Yes | Yes |
| CVE-2022-1282 | Photo Gallery \< 1.6.3 - Reflected Cross-Site Scripting | medium | 6.1 | No | Yes | Yes |
| CVE-2022-1281 | Photo Gallery \< 1.6.3 - Unauthenticated SQL Injection | critical | 9.8 | No | Yes | Yes |
| CVE-2022-0169 | Photo Gallery by 10Web \< 1.6.0 - Unauthenticated SQL Injection | critical | 9.8 | No | Yes | Yes |
| CVE-2021-25041 | Photo Gallery by 10Web \< 1.5.68 - Reflected Cross-Site Scripting (XSS) | medium | 6.1 | No | Yes | Yes |

## Frequently asked questions

### How many CVEs does 10Web photo gallery have?

10Web photo gallery has 49 published CVE records since 2015.

### How many 10Web photo gallery CVEs are in CISA KEV?

None of 10Web photo gallery's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for 10Web photo gallery vulnerabilities?

Yes — 32 of 10Web photo gallery's CVEs have a known public exploit.

### Which versions of 10Web photo gallery are affected?

68 distinct 10Web photo gallery versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in 10Web photo gallery CVEs?

10Web photo gallery's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-862 (Missing Authorization), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

### How many critical 10Web photo gallery vulnerabilities are there?

10Web photo gallery has 6 critical and 6 high-severity CVEs.

### What is the average severity of 10Web photo gallery CVEs?

The average CVSS base score across 10Web photo gallery's scored CVEs is 6.2.

## Other products from this vendor

- [Form Maker](https://radicalnotion.ai/vendor/10web/form-maker) (26 CVEs)
- [Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder](https://radicalnotion.ai/vendor/10web/form-maker-by-10web-mobile-friendly-drag-and-drop-contact-form-builder) (20 CVEs)
- [Photo Gallery by 10Web – Mobile-Friendly Image Gallery](https://radicalnotion.ai/vendor/10web/photo-gallery-by-10web-mobile-friendly-image-gallery) (15 CVEs)
- [slider](https://radicalnotion.ai/vendor/10web/slider) (12 CVEs)
- [Photo Gallery by 10Web](https://radicalnotion.ai/vendor/10web/photo-gallery-by-10web) (6 CVEs)
- [10Web Booster – Website speed optimization, Cache & Page Speed optimizer](https://radicalnotion.ai/vendor/10web/10web-booster-website-speed-optimization-cache-and-page-speed-optimizer) (5 CVEs)
- [PhotoGallery](https://radicalnotion.ai/vendor/10web/photogallery) (5 CVEs)
- [Slider by 10Web](https://radicalnotion.ai/vendor/10web/slider-by-10web) (5 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/10web/photo-gallery). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.