The Photo Gallery by 10Web plugin for WordPress contains a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts via admin settings, which execute when users view the injected pages. This vulnerability affects multi-site setups or installations with unfiltered_html disabled, in all versions up to 1.8.30. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and a scope change with low confidentiality and integrity impact, and no availability impact. No patch or remediation details are currently available.

An attacker with administrator-level permissions on affected WordPress installations can inject malicious scripts that execute in the context of users visiting the injected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability. It only affects multi-site installations or those with unfiltered_html disabled, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or limiting use of the affected plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once available.