CVE-2026-92974 is a reflected cross-site scripting vulnerability in the Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin affecting all versions up to 1.8.46. The flaw arises from insufficient input sanitization and output escaping of the 'thumb_url' parameter. The vulnerability can be exploited by unauthenticated attackers to inject malicious scripts that execute in the context of an authenticated user who has the manage_options capability. The AJAX action 'editimage_bwg' performs a capability check but does not verify a nonce, allowing payload delivery via crafted GET requests without CSRF protection.

Successful exploitation can lead to execution of arbitrary scripts in the context of an authenticated user with manage_options capability, potentially allowing attackers to perform actions with elevated privileges or steal sensitive information accessible to that user. The vulnerability does not allow privilege escalation or denial of service directly but can compromise confidentiality and integrity of user sessions.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict access to users with manage_options capability and avoid clicking on untrusted links that could exploit the 'thumb_url' parameter. Implementing additional web application firewall (WAF) rules to detect and block malicious payloads targeting this parameter may help reduce risk.