PT-2021-16398 · 10Web · The Photo Gallery

Thuramoemyint · Published 2021-12-06 · Updated 2025-10-29 · CVE-2021-25041

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web WordPress plugin versions prior to 1.5.68

Description: The issue is related to Reflected Cross-Site Scripting (XSS) via the bwg album breadcrumb 0 and shortcode id GET parameters passed to the bwg frontend data AJAX action.

Recommendations: For versions prior to 1.5.68, update to version 1.5.68 or later to resolve the issue. As a temporary workaround, consider restricting access to the bwg frontend data AJAX action to minimize the risk of exploitation. Avoid using the bwg album breadcrumb 0 and shortcode id parameters in the affected AJAX action until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25041

Affected Products

The Photo Gallery

References · 7

• 🔥 https://wpscan.com/vulnerability/32aee3ea-e0af-44da-a16c-102c83eaed8f · Exploit
• https://osv.dev/vulnerability/CVE-2021-25041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25041 · Security Note
• https://plugins.trac.wordpress.org/changeset/2467205 · Patch
• https://t.me/cibsecurity/33380 · Telegram Post
• https://t.me/cveNotify/140802 · Telegram Post
• https://t.me/cvenotify/24263 · Telegram Post