{"affected":[{"defaultStatus":"unaffected","product":"Photo Gallery by 10Web","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.8.49","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-110072","cwes":["CWE-79"],"description":"The Photo Gallery by 10Web  WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/6bf17a5c-21c4-4e0e-b0a4-aee18c9820f1/"}],"kev":null,"metrics":[],"modifiedAt":1794463206497,"publishedAt":1794463206497,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/6bf17a5c-21c4-4e0e-b0a4-aee18c9820f1/"}],"remediation":[],"revision":"a853749995518858b27a08554a3c84880087ef28019a9e8942ce0f20f3cc4a26","sources":[{"modifiedAt":1794463206497,"name":"CNA: WPScan","retrievedAt":1794467304117,"url":"https://www.cve.org/CVERecord?id=CVE-2026-110072"}],"ssvc":null,"status":"published","title":"Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attribute","updatedAt":1794467304117}