The Photo Gallery by 10Web plugin for WordPress suffers from a stored cross-site scripting vulnerability via the 'svg' parameter. This occurs because the plugin does not properly neutralize input or escape output, allowing authenticated attackers with administrator or contributor privileges (in pro versions) to inject arbitrary scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 1.8.23. No known exploits are reported in the wild, and no vendor advisory or patch information is provided in the data.

Successful exploitation allows authenticated users with elevated privileges (administrators or contributors in pro versions) to inject malicious scripts that execute in other users' browsers when they access the affected pages. This can lead to information disclosure or session hijacking. The impact is limited by the requirement for authenticated access with specific roles. There is no indication of denial of service or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative and contributor access to trusted users only. Monitor plugin updates from 10Web for an official fix. Avoid using the vulnerable 'svg' parameter or disable the plugin if possible as a temporary measure.