CVE-2026-92974 10web CVE debrief

Who should care

WordPress administrators and users with the manage_options capability should assess exposure and prioritize remediation to prevent potential attacks. This includes reviewing the plugin versions in use, updating to the latest version, and implementing additional security measures such as input sanitization and output escaping for the 'thumb_url' parameter.

Why it matters

CVE-2026-92974 is a Reflected Cross-Site Scripting vulnerability in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress. WordPress administrators and users with the manage_options capability should assess exposure and prioritize remediation to prevent potential attacks.

• Unauthenticated attackers may inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action.
• The vulnerability requires that the authenticated victim holds the manage_options capability.
• Exploitation can be delivered via a crafted GET request without a CSRF token.

Technical summary

The vulnerability exists in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress, affecting all versions up to and including 1.8.46. The 'thumb_url' parameter is vulnerable to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts, provided they can trick a user with the manage_options capability into performing an action. The exploitation can be delivered via a crafted GET request without a CSRF token.

Defensive priority

Medium-priority defensive actions are recommended to address this vulnerability.

Recommended defensive actions

• Review and update the plugin to the latest version.
• Implement input sanitization and output escaping for the 'thumb_url' parameter.
• Monitor for potential attacks and update incident response plans.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score of 6.1, and affected versions up to 1.8.46. The vulnerability was publicly disclosed on October 3, 2026. There is no information on known or unknown affected scope beyond the specified versions. Defenders should verify the presence of the vulnerable plugin in their environments and review the official advisory for further details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.