An unauthenticated attacker can execute arbitrary JavaScript in an administrator's session via a crafted link, leading to potential site takeover.

This is a Cross-Site Scripting (XSS) vulnerability (CWE-79) occurring because the plugin fails to sanitize request parameters before reflecting them into input attributes on admin pages. An unauthenticated attacker can leverage this to execute malicious scripts when an administrator clicks a crafted link.

The exploitation of this vulnerability allows an attacker to perform actions on behalf of an authenticated administrator, which can lead to the unauthorized modification of site content, creation of new administrative accounts, or complete site compromise. With a CVSS score of 7.1, this is a high-severity risk that could result in significant reputational damage and loss of administrative control over the WordPress environment.

Immediate Action: Update the Photo Gallery by 10Web plugin to version 1.8.44 or later to ensure proper input sanitization is applied.

Proactive Monitoring: Review web server and WordPress access logs for suspicious requests containing JavaScript payloads or unusual redirection patterns targeting the admin dashboard.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured rules to detect and block malicious XSS payloads in request parameters.

Public Exploit Available: Unknown.

Given the potential for administrative account compromise, immediate action is required. Organizations utilizing the Photo Gallery by 10Web plugin should verify their current version and update to version 1.8.44 immediately to mitigate this high-severity cross-site scripting risk.