The Photo Gallery by 10Web plugin for WordPress suffers from a reflected XSS vulnerability (CWE-79) due to improper neutralization of input in the 'image_id' parameter. This flaw affects all versions up to 1.8.34 and allows unauthenticated attackers to inject malicious scripts that execute in the context of an administrative user's browser when they interact with a crafted URL. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.1 (Network attack vector, low attack complexity, no privileges required, requires user interaction, impacts confidentiality and integrity, no impact on availability). No patch or official fix has been documented in the provided data.

Successful exploitation can lead to execution of arbitrary scripts in the context of an administrative user, potentially compromising confidentiality and integrity of the affected system. This could allow attackers to perform actions with the privileges of the admin user if they are tricked into clicking a malicious link. There is no indication of impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links received from untrusted sources and consider restricting access to the plugin or disabling it if feasible. Monitor vendor communications for updates regarding patches or official mitigations.