The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.

Source