Quick answers
- Is CVE-2026-42715 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42715 being exploited in the wild.
- How severe is CVE-2026-42715?
- High severity, with a CVSS score of 7.1, published 10 October 2026.
- Which products and versions are affected?
- 10Web Photo Gallery <= 1.8.47.
- Is there a fix for CVE-2026-42715?
- Yes: fixed in 1.8.48. Until then: Patchstack provides a mitigation rule to block attack attempts. If immediate patching is not possible, restrict access to the plugin or disable it until an update can be deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42715 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-42715?
- Check whether you run 10Web Photo Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.8.48
Patchstack provides a mitigation rule to block attack attempts. If immediate patching is not possible, restrict access to the plugin or disable it until an update can be deployed.
Technical details
This is a stored or reflected XSS vulnerability in Photo Gallery by 10Web versions up to 1.8.47 that requires no authentication to trigger. The vulnerability allows an attacker to inject arbitrary JavaScript into the plugin's output, which executes in the context of the website. User interaction is required for successful exploitation (e.g., clicking a malicious link or visiting a crafted page).
Affected products
- 10Web Photo Gallery <= 1.8.47
Timeline
- 2026-10-10: disclosed
- 2026-10-07: patched: Patched version 1.8.48 released