---
id: CVE-2026-85652
title: >-
  The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for
  WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode
  Attribute in all versions up to, and including, 1.8.44 due to insufficient
  escaping on the…
summary: >-
  The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for
  WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode
  Attribute in all versions up to, and including, 1.8.44 due to insufficient
  escaping on the…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
vendor: 10web
product: Photo Gallery by 10Web – Mobile-Friendly Image Gallery
affected:
  - photo_gallery_by_10web_mobile-friendly_image_gallery <= 1.8.44
published: '2026-09-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:17:29.143'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85652'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.42/framework/WDWLibrary.php#L75
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.42/frontend/controllers/controller.php#L51
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.42/frontend/models/model.php#L172
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.42/frontend/models/model.php#L178
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.44/framework/WDWLibrary.php#L75
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.44/frontend/controllers/controller.php#L51
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.44/frontend/models/model.php#L172
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/photo-gallery/tags/1.8.44/frontend/models/model.php#L178
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3687152%40photo-gallery&new=3687152%40photo-gallery
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/c9dca86f-b853-4d29-ae43-bd6ea74d058d?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.0041
epssPercentile: 0.35012
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T19:16:23.054079Z'
ingestedAt: '2026-09-18T08:38:04.105Z'
---

## Overview

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An Author-level user can store a SQL injection payload inside a published post's shortcode attribute, causing the payload to execute when any visitor renders the post; notably, the unsanitized value appears on both sides of a UNION query, potentially doubling the observable time-based delay.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.