What is the CVSS score of CVE-2026-10095?

CVE-2026-10095 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

WP Photo Album Plus CVE-2026-10095

EUVD-2026-40942 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 Wordfence

GHSA-f7vj-52f2-pr4x

WordPress XSS Wp Photo Album Plus Wordpress Plugin

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires the admin victim to view the injected post (UI:R); contributor auth required (PR:L); payload executes in admin scope across trust boundary (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 11:07 vuln.today

CVE Published

Jul 01, 2026 - 09:32 cve.org

MEDIUM 6.4

DescriptionCVE.org

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can embed the malicious [photo] shortcode in a post submitted for review, causing the stored payload to execute when an administrator or any other user views the post.

AnalysisAI

Stored Cross-Site Scripting in WP Photo Album Plus (WordPress plugin, all versions through 9.1.13.005) allows contributor-level authenticated attackers to inject persistent JavaScript payloads via the unsanitized 'subtext' parameter of the [photo] shortcode. The CVSS scope change (S:C) is the critical amplifier: a low-privileged contributor can embed malicious shortcodes in posts submitted for editorial review, causing the stored payload to execute in administrator browser sessions when the content is previewed - enabling session hijacking and potential full site takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and common WordPress contributor registration practices make this a realistic threat on affected installations.

Technical ContextAI

WP Photo Album Plus is a WordPress plugin (CPE: cpe:2.3:a:opajaap:wp_photo_album_plus) providing photo gallery functionality through WordPress shortcodes. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting): the 'subtext' shortcode parameter is written to the database and later rendered into HTML without adequate sanitization or output escaping. Vulnerable code paths are confirmed in wppa-functions.php at line 4291 and wppa-filter.php at lines 1151, 1301, and 1320, spanning both input filtering and output rendering stages - indicating the flaw is not a single missed escape call but a systemic sanitization gap. WordPress shortcode architecture is central to the attack surface: contributors can embed shortcodes in post content which is processed server-side on render, and the content review workflow means administrators routinely load contributor-submitted content in privileged browser sessions before publication.

RemediationAI

Upgrade WP Photo Album Plus to version 9.2.01.001 or later; this version is identified as the patched release via the SVN changeset comparison between the 9.1.13.005 and 9.2.01.001 tags (https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-photo-album-plus/tags/9.1.13.005&new_path=%2Fwp-photo-album-plus/tags/9.2.01.001). The specific fix to wppa-filter.php is captured in changeset 3557877 (https://plugins.trac.wordpress.org/changeset/3557877/wp-photo-album-plus/trunk/wppa-filter.php). Note that 9.2.01.001 is inferred from SVN tag comparison referenced in the advisory - a formal vendor security bulletin has not been independently confirmed, so administrators should verify the release through the official WordPress plugin repository. If immediate patching is not possible, restrict the contributor role to explicitly trusted users and disable open user registration; this eliminates the lowest-effort attack path since unauthenticated users cannot exploit this flaw. A WordPress application firewall with XSS rule sets (e.g., Wordfence Premium WAF) can provide partial mitigation but may produce false positives on legitimate shortcode usage and should be tested in audit mode before enforcement.