CVE-2026-86311

MediumCVSS 6.4/10Last modified Sep 17, 2026

Description

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
10webPhoto Gallery by 10Web – Mobile-Friendly Image Gallery<= 1.8.44

References

Timeline

Published
Sep 17, 2026
Last modified
Sep 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-863137.8Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow Buffers. This issue affects Walrus: af80e665ea49d9003695a665CVE-2026-863146.2Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote atCVE-2026-863156.2An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScriCVE-2026-863175.3A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/srCVE-2026-863185.3A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchDCVE-2026-863195.3A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of tCVE-2026-86327.8A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allowCVE-2026-863207.8A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can CVE-2026-863215.3A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file srCVE-2026-863259.4A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insuffCVE-2026-863268.6An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify thCVE-2026-86339.8IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Appli