Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter

2026-07-01 20:06

Ravindu Lakmina Munaweera

Strategic Overview

Status

Patched in 1.5.1.9

Affected PluginProduct Video Gallery for Woocommerce

Affected Version<= 1.5.1.8

CVSS4.4Medium

CVECVE-2026-10104

View all Product Video Gallery for Woocommerce vulnerabilities

Vulnerability Overview

The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom_thumbnail Parameter in all versions up to, and including, 1.5.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Technical Analysis

REMEDIATION: Update to version 1.5.1.9, or a newer patched version --- IDENTIFIER: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

External References

https://www.cve.org/CVERecord?id=CVE-2026-10104 https://www.wordfence.com/threat-intel/vulnerabilities/id/f61885bc-b7da-42b8-a0d3-ba5d7d19b536