CVE-2026-18557: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery

CVE-2026-18557 is a reflected Cross-Site Scripting vulnerability in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin. The flaw exists in all versions up to and including 1.8.42 due to improper neutralization of input in the 'title' parameter. An attacker can exploit this by injecting malicious scripts that execute in the context of a victim's browser when they perform an action like clicking a crafted link. The CVSS v3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to partial disclosure of sensitive information or manipulation of web page content. There is no impact on availability. The vulnerability requires user interaction and does not require privileges.

No official patch or fix is currently documented in the provided data. Users should monitor the vendor's advisory channels for updates. Until a fix is available, avoid clicking on suspicious links that may exploit this vulnerability. Implementing web application firewall (WAF) rules to detect and block reflected XSS attempts targeting the 'title' parameter may provide temporary mitigation.