CVE-2026-86311 is a stored cross-site scripting vulnerability (CWE-79) in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin. It affects all versions up to 1.8.44 due to improper neutralization of input in shortcode attributes. Authenticated attackers with Author-level access or higher can inject arbitrary web scripts that execute in the context of users viewing the injected pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the author level. The vulnerability impacts confidentiality and integrity but not availability.

An attacker with Author-level or higher privileges can inject malicious scripts via shortcode attributes that persist in the application and execute when other users access the affected pages. This can lead to unauthorized actions or data disclosure within the context of the affected site. The vulnerability does not affect availability but impacts confidentiality and integrity.

No official patch or fix information is provided in the vendor advisory or source data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or limiting use of shortcode attributes in the plugin. Monitor vendor communications for updates and apply patches promptly once released.