Plugin security history

Photo Gallery by 10Web – Mobile-Friendly Image Gallery Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 65 vulnerability records associated with Photo Gallery by 10Web – Mobile-Friendly Image Gallery, published between 2014 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

65Total records

6Critical

6High

51Medium

1Low

1Informational

65Patched records

0Currently marked unpatched

2014-05-07First disclosure

2026-06-05Latest disclosure

54 of 65CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	2	2 records
2015	5	5 records
2017	4	4 records
2019	6	6 records
2020	2	2 records
2021	9	9 records
2022	11	11 records
2023	3	3 records
2024	14	14 records
2025	4	4 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
Critical	6	9.2%
High	6	9.2%
Medium	51	78.5%
Low	1	1.5%
Informational	1	1.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

39 records60%

First: 2014. Latest: 2025.

SQL Injection

12 records18.5%

First: 2015. Latest: 2026.

Path Traversal

5 records7.7%

First: 2017. Latest: 2024.

Missing Authorization

4 records6.2%

First: 2023. Latest: 2026.

CSRF

2 records3.1%

First: 2014. Latest: 2026.

Other

2 records3.1%

First: 2019. Latest: 2022.

Arbitrary File Upload

1 record1.5%

First: 2015. Latest: 2015.

Patch Status

Patched: 65
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.8.42
1.8.41
1.8.38
1.8.37
1.8.39
1.8.35
1.8.34
1.8.33
1.8.31
1.8.29
1.8.28
1.8.24
1.8.26
1.8.21
1.8.22
1.8.20
1.8.19
1.8.16
1.8.15
1.8.3
1.8.8
1.8.1
1.7.1
1.6.9
1.6.8
1.6.7
1.6.4
1.6.3
1.6.0
1.5.79
1.5.75
1.5.67
1.5.69
1.5.68
1.5.55
1.5.46
1.5.35
1.5.31
1.5.25
1.5.23
1.3.67
1.3.51
1.3.43
1.3.38
1.2.13
1.2.6
1.2.11
1.2.8
1.1.31
1.2.42

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.5.34`	Photo Gallery by 10Web <= 1.5.34 - Cross-Site Scripting	September 8, 2019	1.5.35	Medium
`[*, 1.5.31)`	Photo Gallery by 10Web <= 1.5.30 - SQL Injection	July 26, 2019	1.5.31	Critical
`*-1.5.24`	Photo Gallery by 10Web <= 1.5.24 - Authenticated Local File Inclusion	May 15, 2019	1.5.25	Medium
`*-1.5.22`	Photo Gallery by 10Web <= 1.5.22 - Authenticated Cross-Site Scripting	May 13, 2019	1.5.23	Medium
`[*, 1.3.67)`	Photo Gallery by 10Web <= 1.3.66 - Cross-Site Scripting	December 14, 2017	1.3.67	Medium
`[*, 1.3.51)`	Photo Gallery by 10Web <= 1.3.50 - Authenticated SQL Injection via tag_id Parameter	August 20, 2017	1.3.51	High
`[*, 1.3.43)`	Photo Gallery by 10Web < 1.3.43 - Authenticated Path Traversal	June 16, 2017	1.3.43	Medium
`[*, 1.3.38)`	Photo Gallery by 10Web <= 1.3.37 - Authenticated SQL Injection	May 2, 2017	1.3.38	High
`[*, 1.2.13)`	Photo Gallery by 10Web <= 1.2.12 - Authenticated Cross-Site Scripting	March 13, 2015	1.2.13	Medium
`[*, 1.2.6)`	Photo Gallery by 10Web <= 1.2.5 - Unrestricted File Upload	February 12, 2015	1.2.6	High
`[*, 1.2.11)`	Photo Gallery by 10Web <= 1.2.10 - Authenticated Cross-Site Scripting	January 28, 2015	1.2.11	Medium
`[*, 1.2.11)`	Photo Gallery by 10Web <= 1.2.10 - Authenticated SQL Injection via asc_or_desc Parameter	January 23, 2015	1.2.11	High
`[*, 1.2.8)`	Photo Gallery by 10Web <= 1.2.7 - Unauthenticated Blind SQL Injection via order_by Parameter	January 12, 2015	1.2.8	Critical
`*-1.1.30`	Photo Gallery by 10Web <= 1.1.30 - Reflected Cross-Site Scripting	October 1, 2014	1.1.31	Low
`[*, 1.2.42)`	Photo Gallery by 10Web <= 1.2.41 - Cross-Site Request Forgery	May 7, 2014	1.2.42	High

Selected source records

Latest Records

MediumCVE-2026-9829

Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter

Published: June 5, 2026

Affected versions: *-1.8.41
Patched versions: 1.8.42

Original Wordfence record

MediumCVE-2026-49771

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection

Published: June 4, 2026

Affected versions: *-1.8.41
Patched versions: 1.8.42

Original Wordfence record

MediumCVE-2026-7048

Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute

Published: May 27, 2026

Affected versions: *-1.8.40
Patched versions: 1.8.41

Original Wordfence record

MediumCVE-2026-32330

Photo Gallery by 10Web <= 1.8.37 - Cross-Site Request Forgery

Published: February 8, 2026

Affected versions: *-1.8.37
Patched versions: 1.8.38

Original Wordfence record

MediumCVE-2026-1036

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion

Published: January 21, 2026

Affected versions: *-1.8.36
Patched versions: 1.8.37

Original Wordfence record

MediumCVE-2026-27360

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.38 - Authenticated (Editor+) Stored Cross-Site Scripting

Published: December 25, 2025

Affected versions: *-1.8.38
Patched versions: 1.8.39

Original Wordfence record

MediumCVE-2025-2269

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter

Published: April 11, 2025

Affected versions: *-1.8.34
Patched versions: 1.8.35

Original Wordfence record

MediumCVE-2025-0613

Photo Gallery by 10Web <= 1.8.33 - Unauthenticated Stored Cross-Site Scripting

Published: March 10, 2025

Affected versions: *-1.8.33
Patched versions: 1.8.34

Original Wordfence record

Highest-Severity Records

CriticalCVE-2015-1055

Photo Gallery by 10Web <= 1.2.7 - Unauthenticated Blind SQL Injection via order_by Parameter

Published: January 12, 2015

Affected versions: [*, 1.2.8)
Patched versions: 1.2.8

Original Wordfence record

CriticalCVE-2021-24139

Photo Gallery by 10Web <= 1.5.54 - SQL Injection via bwg_search_x Parameter

Published: May 15, 2020

Affected versions: [*, 1.5.55)
Patched versions: 1.5.55

Original Wordfence record

CriticalCVE-2019-14313

Photo Gallery by 10Web <= 1.5.30 - SQL Injection

Published: July 26, 2019

Affected versions: [*, 1.5.31)
Patched versions: 1.5.31

Original Wordfence record

CriticalCVE-2019-16119

Photo Gallery by 10Web <= 1.5.34 - SQL Injection

Published: September 8, 2019

Affected versions: [*, 1.5.35)
Patched versions: 1.5.35

Original Wordfence record

CriticalCVE-2022-0169

Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter

Published: February 15, 2022

Affected versions: [*, 1.6.0)
Patched versions: 1.6.0

Original Wordfence record

CriticalCVE-2024-0221

Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename

Published: January 19, 2024

Affected versions: *-1.8.19
Patched versions: 1.8.20

Original Wordfence record

High

Photo Gallery by 10Web <= 1.3.37 - Authenticated SQL Injection

Published: May 2, 2017

Affected versions: [*, 1.3.38)
Patched versions: 1.3.38

Original Wordfence record

HighCVE-2022-1281

Photo Gallery by 10Web <= 1.6.2 - SQL Injection

Published: April 11, 2022

Affected versions: [*, 1.6.3)
Patched versions: 1.6.3

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory