Photo Gallery by 10Web – Mobile-Friendly Image Gallery
by 10Web · Media
Also makes 7 other plugins · 223.9K+ installs across the portfolio →
Photo Gallery is a powerful image gallery plugin with a list of advanced options for creating responsive image galleries with beautiful lightbox.
78 health vs 59 average across 2,206 Media plugins
Directory ranking optimization
How it's scored →How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.
Excellent listing optimization
Biggest win: Support resolution
To rank higher: Mark more forum threads resolved — the resolved ratio feeds the ranking.
Get the full rank-higher report →Daily downloads
Since 2022-10-05 · 1,421 days · wp.org + Plugin Pulse archive
30-day downloads
Rolling 30-day volume · peaks are release surges
88.7K
now · peak 365.8K
Directory rank vs rivals
wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you
Rating trend
Star average over time · dips mark rough releases
Update activity
How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.
Release cadence
Actively maintainedHow often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.
6
releases in the last 12 months
3mo ago
latest release · v1.8.42
380
tagged releases on record
Recent releases
What its installed base runs
via wordpress.orgShare of active installs on each version of this plugin · 79% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.
Estimated active installs
The public count shows “100K+”. Our estimate pins where the real number sits.
Refined from the date this plugin crossed into its current band.
Install history · since 2015-08-13 · 1,500 observations
Estimated value
What this plugin might earn a year, and what it might sell for. Modeled from public signals; we don't see anyone's books.
Est. annual revenue
Est. acquisition value
No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. The recent download trend is too spiky to read.
Details
Recent reviews
All reviews on wp.org ↗- ★★★★★ matzomanik5mo ago
Die Einstellungsmöglichkeiten für die Galerie sowie auch die Lightbox sind in der kostenlosen Version recht umfangreich. Es lässt sich sogar für die Bilder auch ein Rechtsklick-Schutz sowie ein Wasserzeichen als Text oder Bild (png) einstellen. Das Design ist z.T. nicht ganz aktuell, lässt sich jedoch alles einstellen und anpassen. Das bedeutet jedoch dann etwas Aufwand oder man deaktiviert z.B. in der Lightbox einige Funktionen um einfacher und auch schicker zu halten. This topic was modified 4 months, 1 week ago by matzomanik.
Read on wp.org ↗ - ★★★★★ Malae6mo ago
Support issues about PHP notices are dismissed and PHP warnings are not answered.
Read on wp.org ↗ - ★★★★★ ludwigarcache6mo ago
What should be simple is overly complicated. The UI is confusing and basic gallery setup takes far too many steps. Not user-friendly at all.
Read on wp.org ↗ - ★★★★★ shumustudios8mo ago
I’ve discovered this plugin in 2018 (I think). Now I rebuilt my website, glad to see the plugin is still awesome 😀
Read on wp.org ↗ - ★★★★★ megalitosmyr9mo ago
UN plugin sencillo y práctico para crear galerías fotográficas.
Read on wp.org ↗ - ★★★★★ powerphot11mo ago
Thank you!
Read on wp.org ↗ - ★★★★★ dejanikolic11mo ago
can we expect an update from photogallery soon, it hasn’t been for a long time, and it’s causing me a conflict with the Photograph theme, it’s creating a wrong sitemap
Read on wp.org ↗ - ★★★★★ Tomperys11mo ago
Sadly the new developers (after the plugin was bought by 10web) are forcing you to use their lightbox as a fixed component. The original Gallery plugin before 10web took it over, allowed you to use our own lightbox. Well, I had to cancel my subscription and I will find another photo gallery plugin. They dont even care about paying customers….
Read on wp.org ↗
Latest updates
via wp.org changelogRecent releases and news for this plugin
Known vulnerabilities
via Wordfence Intelligence65 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.
- 2026-06-05 CVE-2026-9829 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.8.41 Patched in 1.8.42
- Medium · 6.5 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection ↗2026-06-04 CVE-2026-49771 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.8.41 Patched in 1.8.42
- Medium · 6.5 Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute ↗2026-05-27 CVE-2026-7048 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.8.40 Patched in 1.8.41
- 2025-12-25 CVE-2026-27360 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.38 Patched in 1.8.39
- 2025-04-11 CVE-2025-2269 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.34 Patched in 1.8.35
- 2025-03-10 CVE-2025-0613 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.33 Patched in 1.8.34
- 2025-03-02 CVE-2024-13124 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.32 Patched in 1.8.33
- 2024-11-14 CVE-2024-10704 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.30 Patched in 1.8.31
- Medium · 4.4 Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗2024-11-04 CVE-2024-9878 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.30 Patched in 1.8.31
- Medium · 4.4 Photo Gallery by 10Web <= 1.8.28 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗2024-10-03 CVE-2024-8670 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.28 Patched in 1.8.29
- Medium · 4.4 Photo Gallery by 10Web <= 1.8.27 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗2024-09-23 CVE-2024-44043 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.27 Patched in 1.8.28
- 2024-06-06 CVE-2024-5426 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.23 Patched in 1.8.24
- 2024-04-05 CVE-2024-2296 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.21 Patched in 1.8.22
- Medium · 6.1 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_url' ↗2024-03-26 CVE-2024-29809 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.21 Patched in 1.8.22
- Medium · 6.1 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'current_url' ↗2024-03-26 CVE-2024-29832 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.21 Patched in 1.8.22
- Medium · 6.1 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_id' ↗2024-03-26 CVE-2024-29808 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.21 Patched in 1.8.22
- Medium · 6.1 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'thumb_url' ↗2024-03-26 CVE-2024-29810 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.21 Patched in 1.8.22
- Critical · 9.1 Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename ↗2024-01-19 CVE-2024-0221 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.8.19 Patched in 1.8.20
- Medium · 4.4 Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget ↗2023-12-21 CVE-2023-6924 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.18 Patched in 1.8.19
- Medium · 4.3 Photo Gallery <= 1.8.15 - Missing Authorization ↗
- Medium · 4.9 Photo Gallery by 10Web <= 1.8.14 - Authenticated (Administrator+) Directory Traversal ↗2023-03-21 CVE-2023-1427 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.8.14 Patched in 1.8.15
- 2022-11-28 CVE-2022-4058 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.2 Patched in 1.8.3
- 2022-11-26 URL Redirection to Untrusted Site ('Open Redirect') Affects <= 1.8.7 Patched in 1.8.8
- 2022-11-03 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.0 Patched in 1.8.1
- 2022-08-10 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.7.0 Patched in 1.7.1
- 2022-07-01 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.8 Patched in 1.6.9
- 2022-06-28 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.7 Patched in 1.6.8
- 2022-06-16 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.6.6 Patched in 1.6.7
- 2022-05-16 CVE-2022-1394 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.6.4 Patched in 1.6.4
- 2022-04-11 CVE-2022-1281 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.6.3 Patched in 1.6.3
- 2022-04-11 CVE-2022-1282 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.6.3 Patched in 1.6.3
- Critical · 9.8 Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter ↗2022-02-15 CVE-2022-0169 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.6.0 Patched in 1.6.0
- 2021-07-19 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.78 Patched in 1.5.79
- 2021-07-18 CVE-2021-24363 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects < 1.5.75 Patched in 1.5.75
- 2021-07-18 CVE-2021-24362 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.5.75 Patched in 1.5.75
- Medium · 4.8 Photo Gallery <= 1.5.66 - Authenticated Stored Cross-Site Scripting via Gallery Title ↗2021-05-12 CVE-2021-24310 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.5.67 Patched in 1.5.67
- Medium · 6.1 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.5.68 - Reflected Cross-Site Scripting ↗2021-04-19 CVE-2021-46889 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.68 Patched in 1.5.69
- 2021-04-19 CVE-2021-24291 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.5.69 Patched in 1.5.69
- 2021-04-19 CVE-2021-31693 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.68 Patched in 1.5.69
- 2021-02-23 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.68 Patched in 1.5.69
- 2021-02-03 CVE-2021-25041 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.5.68 Patched in 1.5.68
- 2020-05-15 CVE-2021-24139 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.5.55 Patched in 1.5.55
- 2020-02-25 CVE-2020-9335 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.45 Patched in 1.5.46
- 2019-09-08 CVE-2019-16118 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.34 Patched in 1.5.35
- Critical · 9.8 Photo Gallery by 10Web <= 1.5.34 - SQL Injection ↗2019-09-08 CVE-2019-16119 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.5.35 Patched in 1.5.35
- 2019-09-08 CVE-2019-16117 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.5.35 Patched in 1.5.35
- Critical · 9.8 Photo Gallery by 10Web <= 1.5.30 - SQL Injection ↗2019-07-26 CVE-2019-14313 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.5.31 Patched in 1.5.31
- 2019-05-15 CVE-2019-14798 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 1.5.24 Patched in 1.5.25
- 2019-05-13 CVE-2019-14797 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.22 Patched in 1.5.23
- 2017-12-14 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.3.67 Patched in 1.3.67
- 2017-08-20 CVE-2017-12977 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.3.51 Patched in 1.3.51
- 2017-06-16 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects < 1.3.43 Patched in 1.3.43
- 2017-05-02 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.3.38 Patched in 1.3.38
- 2015-03-13 CVE-2015-2324 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.2.13 Patched in 1.2.13
- 2015-02-12 CVE-2014-9312 Unrestricted Upload of File with Dangerous Type Affects < 1.2.6 Patched in 1.2.6
- 2015-01-28 CVE-2015-1394 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.2.11 Patched in 1.2.11
- High · 8.8 Photo Gallery by 10Web <= 1.2.10 - Authenticated SQL Injection via asc_or_desc Parameter ↗2015-01-23 CVE-2015-1393 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.2.11 Patched in 1.2.11
- Critical · 9.8 Photo Gallery by 10Web <= 1.2.7 - Unauthenticated Blind SQL Injection via order_by Parameter ↗2015-01-12 CVE-2015-1055 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.2.8 Patched in 1.2.8
- 2014-10-01 CVE-2014-6315 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.1.30 Patched in 1.1.31
Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.
CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.
Behavioral tests
via WP HiveAutomated install-time checks, tested on PHP 8.1.12 · WP 7.0
Languages
via translate.wordpress.orgTranslated into 62 languages, 9 at 90% or more
Plus 38 more locales with partial translations.
Growth timeline
Install-tier crossings we have observed, and how long each tier took to outgrow
- 2026-06-15 200K+ → 100K+ down after 1255 days in tier
- 2023-01-07 300K+ → 200K+ down after 3 days in tier
- 2023-01-04 200K+ → 300K+ up after 1 days in tier
- 2023-01-03 300K+ → 200K+ down
Competes with
The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).
-
Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel 100K+ installs · 4.8★ · 5 shared tags A -
Robo Gallery – Photo & Image Slider 40K+ installs · 4.3★ · 5 shared tags A -
Photo Gallery by Ays – Responsive Image Gallery 1K+ installs · 4.5★ · 5 shared tags A -
Photo Gallery by Re Gallery: Responsive Image Gallery with AI SEO 700+ installs · 4.6★ · 5 shared tags A -
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery 300K+ installs · 4.3★ · 4 shared tags B -
Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery 10K+ installs · 4.7★ · 4 shared tags A
Embed this report card
Drop a live Pulse card for Photo Gallery by 10Web – Mobile-Friendly Image Gallery into a readme, a review or a deck. It updates itself.
<iframe src="https://plugins.wpmayor.com/embed/photo-gallery" width="480" height="300" style="border:0" loading="lazy" title="Photo Gallery by 10Web – Mobile-Friendly Image Gallery — Plugin Pulse"></iframe> Photo Gallery by 10Web – Mobile-Friendly Image Gallery: 100K+ active installs, 4.5★ (1,581 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/photo-gallery