The 10Web Photo Gallery plugin prior to 1.5.23 for WordPress has authenticated stored XSS.
10web photo gallery