Photo Gallery by 10Web Vulnerability – Mobile-Friendly Image Gallery – Authenticated (Admin+) Stored Cross-Site Scripting via SVG – CVE-2024-2296 | WordPress Plugin Vulnerability Report

Plugin Name: Photo Gallery by 10Web – Mobile-Friendly Image Gallery

Key Information:

  • Software Type: Plugin
  • Software Slug: photo-gallery
  • Software Status: Active
  • Software Author: 10web
  • Software Downloads: 17,757,662
  • Active Installs: 200,000
  • Last Updated: April 10, 2024
  • Patched Versions: 1.8.22
  • Affected Versions: <= 1.8.21

Vulnerability Details:

  • Name: Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21
  • Title: Authenticated (Admin+) Stored Cross-Site Scripting via SVG
  • Type: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2296
  • CVSS Score: 5.5
  • Publicly Published: April 5, 2024
  • Researcher: Jobert Krohnen
  • Description: The plugin is vulnerable to Stored Cross-Site Scripting via SVG file uploads due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level access to inject arbitrary web scripts in pages, affecting multi-site installations and those where unfiltered_html is disabled.


The Photo Gallery by 10Web plugin for WordPress has a vulnerability in versions up to and including 1.8.21 that allows for stored Cross-Site Scripting via SVG file uploads. This vulnerability has been patched in version 1.8.22.

Detailed Overview:

Discovered by security researcher Jobert Krohnen, this vulnerability specifically targets the plugin's handling of SVG file uploads, making it possible for attackers with administrator-level access to execute arbitrary scripts. Such scripts can potentially compromise the site, leading to unauthorized access or data manipulation. The risk is particularly pronounced in multi-site WordPress installations or in cases where the unfiltered_html capability has been explicitly disabled, emphasizing the need for strict input validation and output encoding practices.

Advice for Users:

  • Immediate Action: Update to version 1.8.22 immediately to mitigate this vulnerability.
  • Check for Signs of Vulnerability: Monitor your website for unusual activities or unauthorized changes to its content, which might indicate exploitation.
  • Alternate Plugins: Consider using alternative image gallery plugins while ensuring they do not have similar vulnerabilities.
  • Stay Updated: Regularly update all plugins to their latest versions to protect against known vulnerabilities.


The swift action by the plugin's developers to release a patched version highlights the critical nature of maintaining up-to-date software. Users should immediately update their installations to version 1.8.22 or later to secure their WordPress sites against this vulnerability.


Detailed Report: 

In today's digital landscape, the security of your online presence is paramount, especially when your website serves as the digital front door to your business. The recent discovery of a significant security vulnerability in the widely used WordPress plugin, "Photo Gallery by 10Web – Mobile-Friendly Image Gallery," underscores the critical need for vigilance and proactive measures in website maintenance. This vulnerability, cataloged as CVE-2024-2296, exposes the risks inherent in even the most reputable and widely adopted digital tools.

About the Plugin:

The "Photo Gallery by 10Web" plugin is a popular solution among WordPress users for creating responsive and mobile-friendly image galleries. With over 17 million downloads and 200,000 active installations, its influence and utility in the WordPress ecosystem are undeniable. Developed by 10web, this plugin has been a staple for website owners looking to enhance their site's visual appeal with galleries and slideshows.

The Vulnerability:

Discovered by security researcher Jobert Krohnen, CVE-2024-2296 is an Authenticated (Admin+) Stored Cross-Site Scripting vulnerability triggered through SVG file uploads. This flaw could allow attackers with administrative access to inject harmful scripts into web pages, potentially leading to unauthorized data access or manipulation. This vulnerability specifically targets versions of the plugin up to and including 1.8.21, with a CVSS score of 5.5, highlighting its moderate severity.

Risks and Potential Impacts:

The exploitation of this vulnerability could lead to several adverse outcomes, including the theft of sensitive information, unauthorized changes to website content, and even complete site compromise. Given the plugin's extensive use, the ripple effects of such breaches could be substantial, affecting countless users and businesses.


In response to this discovery, the developers of the "Photo Gallery by 10Web" plugin acted swiftly to address the issue, releasing a patched version 1.8.22. For users of the plugin, the immediate course of action is to update to this latest version, effectively neutralizing the risk posed by this vulnerability.

Previous Vulnerabilities:

It's noteworthy that this is not an isolated incident for the "Photo Gallery by 10Web" plugin. Since its inception, there have been 43 documented vulnerabilities, underscoring the persistent threat landscape that digital tools face and the ongoing need for updates and patches.

For small business owners juggling myriad responsibilities, staying abreast of every security update and potential vulnerability may seem daunting. However, the security of your website should never be sidelined. Ignoring such updates can leave your digital door wide open to cyber threats, which can have far-reaching implications for your business and customer trust.

The Importance of Vigilance:

This incident serves as a critical reminder of the importance of maintaining up-to-date software on your website. Regularly updating plugins, themes, and the WordPress core is not just about accessing new features but is a fundamental security practice. For small business owners, leveraging managed WordPress hosting services or engaging with a digital security consultant can alleviate the burden of constant vigilance. These services can monitor your site for vulnerabilities, apply necessary updates, and ensure that your online presence remains secure, allowing you to focus on growing your business.

In conclusion, the digital realm is ever-evolving, and so are the threats within it. The discovery of vulnerabilities like CVE-2024-2296 in widely used tools like the "Photo Gallery by 10Web" plugin highlights the need for ongoing vigilance and proactive security measures. For small business owners, the message is clear: the security of your website is integral to the safety of your business and the trust of your customers. Staying informed, taking prompt action when vulnerabilities are disclosed, and seeking professional help if needed are crucial steps in safeguarding your online presence against the ever-present threat of cyber-attacks.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Photo Gallery by 10Web Vulnerability – Mobile-Friendly Image Gallery – Authenticated (Admin+) Stored Cross-Site Scripting via SVG – CVE-2024-2296 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment