Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-04
Wp Photo Album Plus - Security Vulnerability (CVE-2026-119477)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003.
PLUGIN
Wp Photo Album Plus
CVE-2026-119477
Risk Score
Threat Entry
Updated 2026-10-11
Wp Photo Album Plus - Security Vulnerability (CVE-2026-96278)
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because esc_url_raw() strips literal angle brackets but retains HTML entities, which wppaEntityDecode() silently converts back to live HTML tags before jQuery('#wppa-modal-container').html() renders them.
PLUGIN
Wp Photo Album Plus
CVE-2026-96278
Risk Score
Threat Entry
Updated 2026-09-30
Wp Photo Album Plus - Security Vulnerability (CVE-2026-102386)
Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus
PLUGIN
Wp Photo Album Plus
CVE-2026-102386
Risk Score
Threat Entry
Updated 2026-09-21
Wp Photo Album Plus - Security Vulnerability (CVE-2026-87909)
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and…
PLUGIN
Wp Photo Album Plus
CVE-2026-87909
Risk Score
Threat Entry
Updated 2026-09-11
Wp Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2026-18579)
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce failure path for the getshortcodedrenderedfenodelay action serves as the log-write trigger rather than an access barrier — a deliberately failed nonce check causes wppa_log() to record the attacker-supplied X-Forwarded-For value…
PLUGIN
Wp Photo Album Plus
CVE-2026-18579
Risk Score
Threat Entry
Updated 2026-08-26
WP Photo Album Plus - Arbitrary File Upload (CVE-2026-18962)
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.
PLUGIN
WP Photo Album Plus
CVE-2026-18962
Risk Score
Threat Entry
Updated 2026-08-26
WP Photo Album Plus - Cross-Site Request Forgery (CSRF) (CVE-2026-18049)
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
PLUGIN
WP Photo Album Plus
CVE-2026-18049
Risk Score
Threat Entry
Updated 2026-08-26
WP Photo Album Plus - Improper Input Validation (CVE-2026-18048)
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
PLUGIN
WP Photo Album Plus
CVE-2026-18048
Risk Score
Threat Entry
Updated 2026-08-26
WP Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2026-17013)
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.
PLUGIN
WP Photo Album Plus
CVE-2026-17013
Risk Score
Threat Entry
Updated 2026-08-26
WP Photo Album Plus - Cross-Site Request Forgery (CSRF) (CVE-2026-17014)
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.
PLUGIN
WP Photo Album Plus
CVE-2026-17014
Risk Score
Threat Entry
Updated 2026-07-30
Wp Photo Album Plus - SQL Injection (CVE-2026-15344)
The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The export-table endpoint lacks a nonce check, meaning this vulnerability can also be…
PLUGIN
Wp Photo Album Plus
CVE-2026-15344
Risk Score
Threat Entry
Updated 2026-07-02
WP Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2026-57675)
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus
PLUGIN
WP Photo Album Plus
CVE-2026-57675
Risk Score
Threat Entry
Updated 2026-07-01
Wp Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2026-10095)
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can embed the malicious [photo] shortcode in a post submitted for review, causing the stored payload to execute when an administrator or any other…
PLUGIN
Wp Photo Album Plus
CVE-2026-10095
Risk Score
Threat Entry
Updated 2026-06-25
Wp Photo Album Plus - SQL Injection (CVE-2026-54829)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.
PLUGIN
Wp Photo Album Plus
CVE-2026-54829
Risk Score
Threat Entry
Updated 2026-06-17
WP Photo Album Plus - SQL Injection (CVE-2026-39511)
Unauthenticated SQL Injection in WP Photo Album Plus
PLUGIN
WP Photo Album Plus
CVE-2026-39511
Risk Score
Threat Entry
Updated 2026-06-17
WP Photo Album Plus - SQL Injection (CVE-2026-6379)
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
PLUGIN
WP Photo Album Plus
CVE-2026-6379
Risk Score
Threat Entry
Updated 2026-06-17
Wp Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2025-14835)
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Wp Photo Album Plus
CVE-2025-14835
Risk Score
Threat Entry
Updated 2026-06-17
Wp Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2025-8726)
The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppa_user_upload function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in the photo album descriptions that execute in a victim's browser.
PLUGIN
Wp Photo Album Plus
CVE-2025-8726
Risk Score
Threat Entry
Updated 2026-06-17
The WP Photo Album Plus - Security Vulnerability (CVE-2024-10958)
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
The WP Photo Album Plus
CVE-2024-10958
Risk Score
Threat Entry
Updated 2026-06-17
WP Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2024-9951)
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including, 8.8.05.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
WP Photo Album Plus
CVE-2024-9951
Risk Score