CVE-2025-2269

Vulnerability

The Photo Gallery by 10Web plugin for WordPress suffers from a Reflected Cross-Site Scripting vulnerability in all versions up to and including 1.8.34. The flaw resides in the Editimage.php view where the image_id parameter is retrieved via WDWLibrary::get('image_id','0') without proper input sanitization or output escaping [1]. An attacker can inject arbitrary HTML/JavaScript through this parameter.

Exploitation

An unauthenticated attacker can craft a malicious URL with a payload in the image_id parameter. The attack requires social engineering to trick an administrative user (e.g., site administrator) into clicking the link. No additional privileges or authentication are needed.

Impact

Successful exploitation allows the attacker to execute arbitrary web scripts in the context of the victim's browser session. This can lead to session hijacking, site defacement, or further compromise of the WordPress installation, depending on the admin's privileges.

Mitigation

As of the publication date (2025-04-12), no patched version has been released. Users should update to a future version beyond 1.8.34 once available. In the interim, exercise caution by not clicking untrusted links that lead to the plugin's admin pages.