What is GHSA-3cr3-2f7q-j6j2?

GHSA-3cr3-2f7q-j6j2 is a security advisory published by GitHub Security Advisories with Medium severity. The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute...

Which CVE IDs does GHSA-3cr3-2f7q-j6j2 cover?

GHSA-3cr3-2f7q-j6j2 covers the following CVE IDs: CVE-2026-110072. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3cr3-2f7q-j6j2?

GHSA-3cr3-2f7q-j6j2 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-3cr3-2f7q-j6j2MediumCVSS 6.8

The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute...

Vendor

GitHub Security Advisories

Published

November 12, 2026

Last Modified

November 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-110072 →

📋 Description

The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermark image before rendering it into an HTML image attribute, and decodes percent-encoded characters in the value, allowing users with Contributor-level access and above to perform Stored Cross-Site Scripting that executes in the browser of any user, including an administrator, who views the published gallery.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-110072
https://wpscan.com/vulnerability/6bf17a5c-21c4-4e0e-b0a4-aee18c9820f1
https://github.com/advisories/GHSA-3cr3-2f7q-j6j2