CVE-2026-42715: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in 10Web Photo Gallery by 10Web

CVE-2026-42715 is an improper neutralization of input during web page generation (CWE-79) vulnerability in Photo Gallery by 10Web plugin versions up to 1.8.47. It allows unauthenticated attackers to perform cross-site scripting (XSS) attacks by injecting malicious scripts into web pages. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow unauthenticated attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, modification, or denial of service. The CVSS vector indicates impacts on confidentiality, integrity, and availability, but no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying web application firewall (WAF) rules to detect and block XSS attempts targeting this plugin.