# CVE-2026-42715: Photo Gallery by 10Web unauthenticated cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-42715-unauthenticated-cross-site-scripting-xss-in-photo-gallery-by  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-42715 · Severity: high · CVSS 7.1 · Published 2026-10-10

Photo Gallery by 10Web is a WordPress plugin used to display image galleries on websites. An unauthenticated attacker can inject malicious JavaScript code into affected sites, allowing them to steal visitor data, hijack user accounts, or deface web pages without needing a login or special access.

Technologies: [10Web Photo Gallery](https://junglewise.ai/threats/technologies/photo-gallery). Vendors: [10Web](https://junglewise.ai/threats/vendors/10web).

## Quick answers

**Is CVE-2026-42715 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42715 being exploited in the wild.

**How severe is CVE-2026-42715?** High severity, with a CVSS score of 7.1, published 10 October 2026.

**Which products and versions are affected?** 10Web Photo Gallery <= 1.8.47.

**Is there a fix for CVE-2026-42715?** Yes: fixed in 1.8.48. Until then: Patchstack provides a mitigation rule to block attack attempts. If immediate patching is not possible, restrict access to the plugin or disable it until an update can be deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42715 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42715?** Check whether you run 10Web Photo Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.8.48

Patchstack provides a mitigation rule to block attack attempts. If immediate patching is not possible, restrict access to the plugin or disable it until an update can be deployed.

## Technical details

This is a stored or reflected XSS vulnerability in Photo Gallery by 10Web versions up to 1.8.47 that requires no authentication to trigger. The vulnerability allows an attacker to inject arbitrary JavaScript into the plugin's output, which executes in the context of the website. User interaction is required for successful exploitation (e.g., clicking a malicious link or visiting a crafted page).

## Affected products

- 10Web Photo Gallery <= 1.8.47

## Timeline

- 2026-10-10: disclosed
- 2026-10-07: patched: Patched version 1.8.48 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/photo-gallery/vulnerability/wordpress-photo-gallery-by-10web-plugin-1-8-47-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/photo-gallery/vulnerability/wordpress-photo-gallery-by-10web-plugin-1-8-47-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [Photo Gallery by 10Web stored cross-site scripting in watermark attribute](https://junglewise.ai/threats/cve-2026-110072-the-photo-gallery-by-10web-wordpress-plugin-before-1-8-49-does)
- [Photo Gallery by 10Web reflected XSS via thumb_url parameter](https://junglewise.ai/threats/cve-2026-92974-the-photo-gallery-by-10web-mobile-friendly-image-gallery-plugin)
- [Photo Gallery by 10Web PHP object injection](https://junglewise.ai/threats/cve-2026-102377-contributor-php-object-injection-in-photo-gallery-by-10web-1-8)
- [10Web Photo Gallery time-based SQL injection in album_id shortcode attribute](https://junglewise.ai/threats/cve-2026-85652-10web-photo-gallery-time-based-sql-injection-in-album-id)
- [10Web Photo Gallery reflected XSS in admin pages](https://junglewise.ai/threats/cve-2026-12865-10web-photo-gallery-reflected-xss-in-admin-pages)