Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Photo Gallery by 10Web – Mobile-Friendly Image Gallery Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 65 vulnerability records associated with Photo Gallery by 10Web – Mobile-Friendly Image Gallery, published between 2014 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

65Total records
6Critical
6High
51Medium
1Low
1Informational
65Patched records
0Currently marked unpatched
2014-05-07First disclosure
2026-06-05Latest disclosure
54 of 65CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201422 records
201555 records
201744 records
201966 records
202022 records
202199 records
20221111 records
202333 records
20241414 records
202544 records
202655 records

Severity Breakdown

SeverityRecordsShare
Critical69.2%
High69.2%
Medium5178.5%
Low11.5%
Informational11.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

39 records60%

First: 2014. Latest: 2025.

SQL Injection

12 records18.5%

First: 2015. Latest: 2026.

Path Traversal

5 records7.7%

First: 2017. Latest: 2024.

Missing Authorization

4 records6.2%

First: 2023. Latest: 2026.

CSRF

2 records3.1%

First: 2014. Latest: 2026.

Other

2 records3.1%

First: 2019. Latest: 2022.

Arbitrary File Upload

1 record1.5%

First: 2015. Latest: 2015.

Patch Status

Patched
65
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 1.8.42
  • 1.8.41
  • 1.8.38
  • 1.8.37
  • 1.8.39
  • 1.8.35
  • 1.8.34
  • 1.8.33
  • 1.8.31
  • 1.8.29
  • 1.8.28
  • 1.8.24
  • 1.8.26
  • 1.8.21
  • 1.8.22
  • 1.8.20
  • 1.8.19
  • 1.8.16
  • 1.8.15
  • 1.8.3
  • 1.8.8
  • 1.8.1
  • 1.7.1
  • 1.6.9
  • 1.6.8
  • 1.6.7
  • 1.6.4
  • 1.6.3
  • 1.6.0
  • 1.5.79
  • 1.5.75
  • 1.5.67
  • 1.5.69
  • 1.5.68
  • 1.5.55
  • 1.5.46
  • 1.5.35
  • 1.5.31
  • 1.5.25
  • 1.5.23
  • 1.3.67
  • 1.3.51
  • 1.3.43
  • 1.3.38
  • 1.2.13
  • 1.2.6
  • 1.2.11
  • 1.2.8
  • 1.1.31
  • 1.2.42

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-1.8.14Photo Gallery by 10Web <= 1.8.14 - Authenticated (Administrator+) Directory TraversalMarch 21, 20231.8.15Medium
*-1.8.2Photo Gallery <= 1.8.2 - Cross-Site Request Forgery to Stored Cross-Site ScriptingNovember 28, 20221.8.3Medium
*-1.8.7Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.7 - Open RedirectNovember 26, 20221.8.8Medium
*-1.8.0Photo Gallery by 10Web <= 1.8.0 - Reflected Cross-Site ScriptingNovember 3, 20221.8.1Medium
*-1.7.0Photo Gallery <= 1.7.0 - Reflected Cross-Site ScriptingAugust 10, 20221.7.1Medium
*-1.6.8Photo Gallery by 10Web <= 1.6.8 - Authenticated (Admin+) Cross-Site ScriptingJuly 1, 20221.6.9Medium
*-1.6.7Photo Gallery by 10Web <= 1.6.7 - Authenticated (Admin+) Stored Cross-Site ScriptingJune 28, 20221.6.8Medium
*-1.6.6Photo Gallery by 10Web <= 1.6.6 - Reflected Cross-Site ScriptingJune 16, 20221.6.7Medium
[*, 1.6.4)Photo Gallery by 10Web <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site ScriptingMay 16, 20221.6.4Medium
[*, 1.6.3)Photo Gallery by 10Web <= 1.6.2 - Cross-Site ScriptingApril 11, 20221.6.3Medium
[*, 1.6.3)Photo Gallery by 10Web <= 1.6.2 - SQL InjectionApril 11, 20221.6.3High
[*, 1.6.0)Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 ParameterFebruary 15, 20221.6.0Critical
*-1.5.78Photo Gallery by 10Web <= 1.5.78 - Stored Cross-Site Scripting via Uploaded SVGJuly 19, 20211.5.79Medium
[*, 1.5.75)Photo Gallery <= 1.5.74 - Stored Cross-Site Scripting via Uploaded SVGJuly 18, 20211.5.75Medium
[*, 1.5.75)Photo Gallery <= 1.5.74 - File Upload Path TraversalJuly 18, 20211.5.75Medium
[*, 1.5.67)Photo Gallery <= 1.5.66 - Authenticated Stored Cross-Site Scripting via Gallery TitleMay 12, 20211.5.67Medium
*-1.5.68Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.5.68 - Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site ScriptingApril 19, 20211.5.69Medium
[*, 1.5.69)Photo Gallery <= 1.5.68 - Multiple Reflected Cross-Site ScriptingApril 19, 20211.5.69Medium
*-1.5.68Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.5.68 - Reflected Cross-Site ScriptingApril 19, 20211.5.69Medium
*-1.5.68Photo Gallery by 10Web <= 1.5.68 - Cross-Site ScriptingFebruary 23, 20211.5.69Medium
[*, 1.5.68)Photo Gallery <= 1.5.67 - Reflected Cross-Site ScriptingFebruary 3, 20211.5.68Medium
[*, 1.5.55)Photo Gallery by 10Web <= 1.5.54 - SQL Injection via bwg_search_x ParameterMay 15, 20201.5.55Critical
*-1.5.45Photo Gallery by 10Web <= 1.5.45 - Multiple Cross-Site Scripting IssuesFebruary 25, 20201.5.46Medium
[*, 1.5.35)Photo Gallery by 10Web <= 1.5.34 - Cross-Site ScriptingSeptember 8, 20191.5.35Medium
[*, 1.5.35)Photo Gallery by 10Web <= 1.5.34 - SQL InjectionSeptember 8, 20191.5.35Critical

Selected source records

Latest Records

MediumCVE-2026-9829

Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter

Published: June 5, 2026

Affected versions
*-1.8.41
Patched versions
1.8.42
Original Wordfence record
MediumCVE-2026-49771

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection

Published: June 4, 2026

Affected versions
*-1.8.41
Patched versions
1.8.42
Original Wordfence record
MediumCVE-2026-7048

Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute

Published: May 27, 2026

Affected versions
*-1.8.40
Patched versions
1.8.41
Original Wordfence record
MediumCVE-2026-32330

Photo Gallery by 10Web <= 1.8.37 - Cross-Site Request Forgery

Published: February 8, 2026

Affected versions
*-1.8.37
Patched versions
1.8.38
Original Wordfence record
MediumCVE-2026-1036

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion

Published: January 21, 2026

Affected versions
*-1.8.36
Patched versions
1.8.37
Original Wordfence record
MediumCVE-2026-27360

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.38 - Authenticated (Editor+) Stored Cross-Site Scripting

Published: December 25, 2025

Affected versions
*-1.8.38
Patched versions
1.8.39
Original Wordfence record
MediumCVE-2025-2269

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter

Published: April 11, 2025

Affected versions
*-1.8.34
Patched versions
1.8.35
Original Wordfence record
MediumCVE-2025-0613

Photo Gallery by 10Web <= 1.8.33 - Unauthenticated Stored Cross-Site Scripting

Published: March 10, 2025

Affected versions
*-1.8.33
Patched versions
1.8.34
Original Wordfence record

Highest-Severity Records

CriticalCVE-2015-1055

Photo Gallery by 10Web <= 1.2.7 - Unauthenticated Blind SQL Injection via order_by Parameter

Published: January 12, 2015

Affected versions
[*, 1.2.8)
Patched versions
1.2.8
Original Wordfence record
CriticalCVE-2021-24139

Photo Gallery by 10Web <= 1.5.54 - SQL Injection via bwg_search_x Parameter

Published: May 15, 2020

Affected versions
[*, 1.5.55)
Patched versions
1.5.55
Original Wordfence record
CriticalCVE-2019-14313

Photo Gallery by 10Web <= 1.5.30 - SQL Injection

Published: July 26, 2019

Affected versions
[*, 1.5.31)
Patched versions
1.5.31
Original Wordfence record
CriticalCVE-2019-16119

Photo Gallery by 10Web <= 1.5.34 - SQL Injection

Published: September 8, 2019

Affected versions
[*, 1.5.35)
Patched versions
1.5.35
Original Wordfence record
CriticalCVE-2022-0169

Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter

Published: February 15, 2022

Affected versions
[*, 1.6.0)
Patched versions
1.6.0
Original Wordfence record
CriticalCVE-2024-0221

Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename

Published: January 19, 2024

Affected versions
*-1.8.19
Patched versions
1.8.20
Original Wordfence record
High

Photo Gallery by 10Web <= 1.3.37 - Authenticated SQL Injection

Published: May 2, 2017

Affected versions
[*, 1.3.38)
Patched versions
1.3.38
Original Wordfence record
HighCVE-2022-1281

Photo Gallery by 10Web <= 1.6.2 - SQL Injection

Published: April 11, 2022

Affected versions
[*, 1.6.3)
Patched versions
1.6.3
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory