Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Photo Gallery by 10Web – Mobile-Friendly Image Gallery Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 65 vulnerability records associated with Photo Gallery by 10Web – Mobile-Friendly Image Gallery, published between 2014 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

65Total records
6Critical
6High
51Medium
1Low
1Informational
65Patched records
0Currently marked unpatched
2014-05-07First disclosure
2026-06-05Latest disclosure
54 of 65CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201422 records
201555 records
201744 records
201966 records
202022 records
202199 records
20221111 records
202333 records
20241414 records
202544 records
202655 records

Severity Breakdown

SeverityRecordsShare
Critical69.2%
High69.2%
Medium5178.5%
Low11.5%
Informational11.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

39 records60%

First: 2014. Latest: 2025.

SQL Injection

12 records18.5%

First: 2015. Latest: 2026.

Path Traversal

5 records7.7%

First: 2017. Latest: 2024.

Missing Authorization

4 records6.2%

First: 2023. Latest: 2026.

CSRF

2 records3.1%

First: 2014. Latest: 2026.

Other

2 records3.1%

First: 2019. Latest: 2022.

Arbitrary File Upload

1 record1.5%

First: 2015. Latest: 2015.

Patch Status

Patched
65
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 1.8.42
  • 1.8.41
  • 1.8.38
  • 1.8.37
  • 1.8.39
  • 1.8.35
  • 1.8.34
  • 1.8.33
  • 1.8.31
  • 1.8.29
  • 1.8.28
  • 1.8.24
  • 1.8.26
  • 1.8.21
  • 1.8.22
  • 1.8.20
  • 1.8.19
  • 1.8.16
  • 1.8.15
  • 1.8.3
  • 1.8.8
  • 1.8.1
  • 1.7.1
  • 1.6.9
  • 1.6.8
  • 1.6.7
  • 1.6.4
  • 1.6.3
  • 1.6.0
  • 1.5.79
  • 1.5.75
  • 1.5.67
  • 1.5.69
  • 1.5.68
  • 1.5.55
  • 1.5.46
  • 1.5.35
  • 1.5.31
  • 1.5.25
  • 1.5.23
  • 1.3.67
  • 1.3.51
  • 1.3.43
  • 1.3.38
  • 1.2.13
  • 1.2.6
  • 1.2.11
  • 1.2.8
  • 1.1.31
  • 1.2.42

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-1.8.41Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode ParameterJune 5, 20261.8.42Medium
*-1.8.41Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL InjectionJune 4, 20261.8.42Medium
*-1.8.40Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode AttributeMay 27, 20261.8.41Medium
*-1.8.37Photo Gallery by 10Web <= 1.8.37 - Cross-Site Request ForgeryFebruary 8, 20261.8.38Medium
*-1.8.36Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment DeletionJanuary 21, 20261.8.37Medium
*-1.8.38Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.38 - Authenticated (Editor+) Stored Cross-Site ScriptingDecember 25, 20251.8.39Medium
*-1.8.34Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' ParameterApril 11, 20251.8.35Medium
*-1.8.33Photo Gallery by 10Web <= 1.8.33 - Unauthenticated Stored Cross-Site ScriptingMarch 10, 20251.8.34Medium
*-1.8.32Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.32 - Authenticated (Admin+) Stored Cross-Site ScriptingMarch 2, 20251.8.33Medium
*-1.8.30Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.30 - Authenticated (Admin+) Stored Cross-Site ScriptingNovember 14, 20241.8.31Medium
*-1.8.30Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site ScriptingNovember 4, 20241.8.31Medium
*-1.8.28Photo Gallery by 10Web <= 1.8.28 - Authenticated (Administrator+) Stored Cross-Site ScriptingOctober 3, 20241.8.29Medium
*-1.8.27Photo Gallery by 10Web <= 1.8.27 - Authenticated (Administrator+) Stored Cross-Site ScriptingSeptember 23, 20241.8.28Medium
*-1.8.23Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir FunctionJune 6, 20241.8.24Medium
*-1.8.23Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVGJune 6, 20241.8.24Medium
*-1.8.25Photo Gallery by 10Web <= 1.8.25 - Missing Authorization to Notice DismissalMay 27, 20241.8.26Medium
*-1.8.20Photo Gallery by 10Web <= 1.8.20 - Missing AuthorizationApril 25, 20241.8.21Medium
*-1.8.21Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVGApril 5, 20241.8.22Medium
*-1.8.21Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'thumb_url'March 26, 20241.8.22Medium
*-1.8.21Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_id'March 26, 20241.8.22Medium
*-1.8.21Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'current_url'March 26, 20241.8.22Medium
*-1.8.21Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_url'March 26, 20241.8.22Medium
*-1.8.19Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File RenameJanuary 19, 20241.8.20Critical
*-1.8.18Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via WidgetDecember 21, 20231.8.19Medium
[*, 1.8.16)Photo Gallery <= 1.8.15 - Missing AuthorizationJune 2, 20231.8.16Medium

Selected source records

Latest Records

MediumCVE-2026-9829

Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter

Published: June 5, 2026

Affected versions
*-1.8.41
Patched versions
1.8.42
Original Wordfence record
MediumCVE-2026-49771

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection

Published: June 4, 2026

Affected versions
*-1.8.41
Patched versions
1.8.42
Original Wordfence record
MediumCVE-2026-7048

Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute

Published: May 27, 2026

Affected versions
*-1.8.40
Patched versions
1.8.41
Original Wordfence record
MediumCVE-2026-32330

Photo Gallery by 10Web <= 1.8.37 - Cross-Site Request Forgery

Published: February 8, 2026

Affected versions
*-1.8.37
Patched versions
1.8.38
Original Wordfence record
MediumCVE-2026-1036

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion

Published: January 21, 2026

Affected versions
*-1.8.36
Patched versions
1.8.37
Original Wordfence record
MediumCVE-2026-27360

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.38 - Authenticated (Editor+) Stored Cross-Site Scripting

Published: December 25, 2025

Affected versions
*-1.8.38
Patched versions
1.8.39
Original Wordfence record
MediumCVE-2025-2269

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter

Published: April 11, 2025

Affected versions
*-1.8.34
Patched versions
1.8.35
Original Wordfence record
MediumCVE-2025-0613

Photo Gallery by 10Web <= 1.8.33 - Unauthenticated Stored Cross-Site Scripting

Published: March 10, 2025

Affected versions
*-1.8.33
Patched versions
1.8.34
Original Wordfence record

Highest-Severity Records

CriticalCVE-2015-1055

Photo Gallery by 10Web <= 1.2.7 - Unauthenticated Blind SQL Injection via order_by Parameter

Published: January 12, 2015

Affected versions
[*, 1.2.8)
Patched versions
1.2.8
Original Wordfence record
CriticalCVE-2021-24139

Photo Gallery by 10Web <= 1.5.54 - SQL Injection via bwg_search_x Parameter

Published: May 15, 2020

Affected versions
[*, 1.5.55)
Patched versions
1.5.55
Original Wordfence record
CriticalCVE-2019-14313

Photo Gallery by 10Web <= 1.5.30 - SQL Injection

Published: July 26, 2019

Affected versions
[*, 1.5.31)
Patched versions
1.5.31
Original Wordfence record
CriticalCVE-2019-16119

Photo Gallery by 10Web <= 1.5.34 - SQL Injection

Published: September 8, 2019

Affected versions
[*, 1.5.35)
Patched versions
1.5.35
Original Wordfence record
CriticalCVE-2022-0169

Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter

Published: February 15, 2022

Affected versions
[*, 1.6.0)
Patched versions
1.6.0
Original Wordfence record
CriticalCVE-2024-0221

Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename

Published: January 19, 2024

Affected versions
*-1.8.19
Patched versions
1.8.20
Original Wordfence record
High

Photo Gallery by 10Web <= 1.3.37 - Authenticated SQL Injection

Published: May 2, 2017

Affected versions
[*, 1.3.38)
Patched versions
1.3.38
Original Wordfence record
HighCVE-2022-1281

Photo Gallery by 10Web <= 1.6.2 - SQL Injection

Published: April 11, 2022

Affected versions
[*, 1.6.3)
Patched versions
1.6.3
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory