Threat database

The 10Web Booster WordPress plugin up to version 2.34.5 contains a path traversal vulnerability that allows unauthenticated attackers to create arbitrary directories outside the intended cache directory and write a cached page file named 'source.html' into them. The vulnerability arises from unsanitized user input being concatenated into file paths without proper containment checks. While attackers cannot write PHP files or execute code, they can poison the cache and create directories with full permissions.

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin is vulnerable to reflected Cross-Site Scripting (XSS) via the 'title' parameter in all versions up to and including 1.8.42. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with crafted content.

The 10Web Booster WordPress plugin up to version 2.34.10 contains an arbitrary file upload vulnerability due to missing file type validation and leaked authentication nonce. This allows unauthenticated attackers to upload potentially executable files, enabling remote code execution. The vulnerability arises from a world-readable REST nonce file generated during bulk optimization pauses, which bypasses authentication checks.

The Form Maker by 10Web plugin for WordPress up to version 1.15.48 is vulnerable to a blind SQL Injection via the 'inputs' parameter. This vulnerability allows unauthenticated attackers to append SQL queries due to insufficient input escaping and lack of query preparation. The nonce required to exploit this is publicly accessible on pages rendering the form, making exploitation trivial. The vulnerability can lead to unauthorized extraction of sensitive database information.

CVE-2026-42715 is a high-severity cross-site scripting (XSS) vulnerability affecting Photo Gallery by 10Web versions 1.8.47 and earlier. It allows unauthenticated attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. The vulnerability requires user interaction to exploit and has a low attack complexity. No specific patch or remediation details are provided in the available data.

CVE-2026-42711 is a high-severity cross-site scripting (XSS) vulnerability in Slider by 10Web versions up to and including 1.2.63. The flaw allows unauthenticated attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability.

CVE-2026-105885 is a high-severity vulnerability in the Slider by 10Web plugin, affecting versions from initial release up to 1.2.62. It involves deserialization of untrusted data, which can lead to object injection. This vulnerability has a CVSS score of 8.8, indicating a serious risk to confidentiality, integrity, and availability. No official patch or remediation information is provided in the available data.

The 10Web Booster WordPress plugin versions up to and including 2.34.8 are vulnerable to a stored cross-site scripting (XSS) flaw via the 'author' parameter. This vulnerability arises from improper input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue is due to the plugin's handling of the comment author Name value, which can bypass WordPress core sanitization and break out of an HTML attribute context.

The Form Maker by 10Web plugin for WordPress is vulnerable to reflected cross-site scripting (XSS) via the 'inputs' parameter in versions up to and including 1.15.48. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The issue arises from insufficient input sanitization and output escaping.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63.

Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the authenticated victim holds the manage_options capability, as the editimage_bwg AJAX action performs a capability check but no nonce verification, meaning the payload can be delivered via a crafted GET request without a CSRF token.

The Form Maker by 10Web WordPress plugin up to version 1.15.47 is vulnerable to a stored cross-site scripting (XSS) flaw via the Mark on Map Longitude/Latitude fields. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view affected pages. The issue arises from insufficient input sanitization and output escaping.

Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An Author-level user can store a SQL injection payload inside a published post's shortcode attribute, causing the payload to execute when any visitor renders the post; notably, the unsanitized value appears on both sides of a UNION query, potentially doubling the observable time-based delay.

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in shortcode attributes. This affects all versions up to and including 1.8.44. Authenticated users with Author-level permissions or higher can inject malicious scripts that execute when other users view the affected pages.

The Form Maker by 10Web plugin for WordPress is vulnerable to reflected cross-site scripting (XSS) via the bulk_action parameter in versions up to and including 1.15.46. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user is tricked into clicking a crafted link. The vulnerability has a medium severity rating with a CVSS score of 6.1.

CVE-2026-66616 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability in Form Maker by 10Web affecting versions up to 1.15.46. It allows attackers to inject malicious scripts without authentication, requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.