Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Wp Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2024-37416)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.00.002.
PLUGIN
Wp Photo Album Plus
CVE-2024-37416
Risk Score
Threat Entry
Updated 2026-06-17
Wp Photo Album Plus - Security Vulnerability (CVE-2024-4037)
The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to the plugin allowing unauthenticated users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
Wp Photo Album Plus
CVE-2024-4037
Risk Score
Threat Entry
Updated 2026-06-17
Wp Photo Album Plus - Broken Access Control (CVE-2023-49812)
Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
PLUGIN
Wp Photo Album Plus
CVE-2023-49812
Risk Score
Threat Entry
Updated 2026-06-17
Wp Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2023-49813)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
PLUGIN
Wp Photo Album Plus
CVE-2023-49813
Risk Score
Threat Entry
Updated 2026-06-17
Wp Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2021-25115)
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.
PLUGIN
Wp Photo Album Plus
CVE-2021-25115
Risk Score
Threat Entry
Updated 2026-06-17
Wp Photo Album Plus - Cross-Site Scripting (XSS) (CVE-2015-3647)
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) comemail or (2) comname parameter in a wppa do-comment action.
PLUGIN
Wp Photo Album Plus
CVE-2015-3647
Risk Score