Stored XSS in Product Video Gallery for Woocommerce <= 1.5.1.8 (CVE-2026-10104)

Vulnerability Overview Vulnerability Name: Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) CVSS Score: 4.4 (Medium) CVE ID: CVE-2026-10104 Release Date: July 1, 2026 Last Update Date: July 2, 2026 Researcher: Ravindu Lakmina Munaweera Impact Scope Affected Software: Product Video Gallery for Woocommerce Affected Versions: <= 1.5.1.8 Vulnerability Description: The plugin contains a stored cross-site scripting vulnerability in WordPress via the parameter. Due to insufficient input sanitization and output escaping, attackers can inject arbitrary scripts into pages. These scripts will execute when users visit the affected pages. Remediation Fixed Version: 1.5.1.9 Recommended Action: Upgrade to version 1.5.1.9 or later. Additional Information Software Type: Plugin Plugin Slug: product-video-gallery-slider-for-woocommerce Patched: Yes References: - plugins.trac.wordpress.org Notes The vulnerability database API is completely free for personal and commercial use. Detailed API documentation and Webhook configuration instructions are provided. Contact Information Technical Support: 24/7 support, 365 days a year, 1-hour response time. Business Hours: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays). Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved. Other Links Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Social Media Facebook: Link Twitter: Link LinkedIn: Link Email: Link Subscription Subscription Link: Link Additional Resources Documentation: Link Learn More: Link Get Wordfence: Link Disclaimer This record contains copyrighted material; see the bottom of the page for specific copyright information. Contact Information Contact Email: wfi-support@wordfence.com Other Wordfence Intelligence: Provides a free WordPress vulnerability database and API access. Wordfence Premium: Offers advanced features and priority support. Other Links Wordfence Free: Link Wordfence Premium: Link Wordfence Care: Link Wordfence Response: Link Wordfence CLI: Link Wordfence Intelligence: Link Wordfence Central: Link Additional Resources Documentation: Link Learning Center: Link Free Support: Link Premium Support: Link News Blog: Link In The News: Link Vulnerability Advisories: Link About About Wordfence: Link Affiliate Program: Link Employment: Link Contact: Link Security: Link CVE Request Form: Link Subscription Subscription Link: Link Other Wordfence Intelligence: Provides a free WordPress vulnerability database and API access. Wordfence Premium: Offers advanced features and priority support. Other Links Wordfence Free: Link Wordfence Premium: Link Wordfence Care: Link Wordfence Response: Link Wordfence CLI: Link Wordfence Intelligence: Link Wordfence Central: Link Additional Resources Documentation: Link Learning Center: Link Free Support: Link Premium Support: Link News Blog: Link In The News: Link Vulnerability Advisories: Link About About Wordfence: Link Affiliate Program: Link Employment: Link Contact: Link Security: Link CVE Request Form: Link Subscription Subscription Link: Link Other Wordfence Intelligence: Provides a free WordPress vulnerability database and API access. Wordfence Premium: Offers advanced features and priority support. Other Links Wordfence Free: Link Wordfence Premium: Link Wordfence Care: Link Wordfence Response: Link Wordfence CLI: Link Wordfence Intelligence: Link Wordfence Central: Link Additional Resources Documentation: Link Learning Center: Link Free Support: Link Premium Support: Link News Blog: Link In The News: Link Vulnerability Advisories: Link About About Wordfence: Link Affiliate Program: Link Employment: Link Contact: Link Security: Link CVE Request Form: Link Subscription Subscription Link: Link Other Wordfence Intelligence: Provides a free WordPress vulnerability database and API access. Wordfence Premium: Offers advanced features and priority support. Other Links Wordfence Free: Link Wordfence Premium: Link Wordfence Care: Link Wordfence Response: Link Wordfence CLI: Link Wordfence Intelligence: Link Wordfence Central: Link Additional Resources Documentation: Link Learning Center: Link Free Support: Link Premium Support: Link News Blog: Link In The News: Link Vulnerability Advisories: Link About About Wordfence: Link Affiliate Program: Link Employment: Link Contact: Link Security: Link CVE Request Form: Link Subscription Subscription Link: Link Other Wordfence Intelligence: Provides a free WordPress vulnerability database and API access. Wordfence Premium: Offers advanced features and priority support. Other Links Wordfence Free: Link Wordfence Premium: Link Wordfence Care: Link Wordfence Response: Link Wordfence CLI: Link Wordfence Intelligence: Link Wordfence Central: Link Additional Resources Documentation: Link Learni

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in Product Video Gallery for Woocommerce <= 1.5.1.8 (CVE-2026-10104)

More from this source