CVE-2026-110072
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
Nov 12, 2026
Vendor
unknown
Description
The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.