Is CVE-2026-92974 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92974 being exploited in the wild.

How severe is CVE-2026-92974?

Medium severity, with a CVSS score of 6.1, published 3 October 2026.

Which products and versions are affected?

10Web Photo Gallery up to and including 1.8.46.

Is there a fix for CVE-2026-92974?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92974 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92974?

Check whether you run 10Web Photo Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92974: Photo Gallery by 10Web reflected XSS via thumb_url parameter

CVE-2026-92974 · Severity: medium · CVSS 6.1 · Published 2026-10-03

The Photo Gallery by 10Web plugin is a WordPress image gallery tool used by website administrators to display and manage photo galleries. An attacker can inject malicious scripts via a crafted link that exploits insufficient input validation in the plugin's image editing feature. If a logged-in WordPress administrator clicks the link, the attacker's script executes in their browser, potentially allowing account compromise or unauthorized site modifications.

Technologies: 10Web Photo Gallery. Vendors: 10Web.

Quick answers

Is CVE-2026-92974 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92974 being exploited in the wild.
How severe is CVE-2026-92974?: Medium severity, with a CVSS score of 6.1, published 3 October 2026.
Which products and versions are affected?: 10Web Photo Gallery up to and including 1.8.46.
Is there a fix for CVE-2026-92974?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92974 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92974?: Check whether you run 10Web Photo Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin contains a reflected XSS vulnerability in the thumb_url parameter of the editimage_bwg AJAX action due to insufficient input sanitization and output escaping. The vulnerability requires an authenticated victim with manage_options capability, and while a capability check is performed, no nonce verification is present, allowing delivery via GET requests without CSRF protection. An unauthenticated attacker can craft a malicious URL containing JavaScript that executes when the victim accesses it.

Affected products

10Web Photo Gallery up to and including 1.8.46

Timeline

2026-10-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.