WP Photo Album Plus CVE-2026-102386

Requires an authenticated WordPress account with at least Subscriber-level privileges (PR:L) on a site running WP Photo Album Plus version 9.3.02.003 or earlier, plus victim user interaction (UI:R) - a higher-privileged user such as an administrator must view the page carrying the injected payload for the script to execute. Exploitation is limited by the need for a valid low-privileged account (open registration must be enabled or the attacker must otherwise obtain credentials) and by the social-engineering/interaction requirement; it does not work against default configurations without a registered account.

This is a genuine but low-to-moderate priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) describes an authenticated stored/reflected XSS: an attacker needs a valid low-privileged WordPress account (Subscriber, PR:L) and must lure a victim into interacting (UI:R). The scope change (S:C) reflects XSS crossing the plugin's security context into the browser/site context, which inflates the score to 6.5 despite each impact being only Low (C:L/I:L/A:L). No EPSS score, no CISA KEV listing, and no public POC were provided, so real-world exploitation pressure appears speculative rather than demonstrated. There is no conflicting-signal problem here - the description ('Subscriber Cross Site Scripting') is consistent with PR:L and the CWE-79 classification. Net: a real, patchable defect but not an urgent, mass-exploited threat; the Subscriber-account and user-interaction requirements meaningfully limit practical impact.

An attacker registers or obtains a WordPress Subscriber account on a site running WP Photo Album Plus <= 9.3.02.003 and injects malicious JavaScript through a plugin input that is not properly sanitized/escaped. When an administrator or another user views the affected page (UI:R), the script executes in their browser session, potentially enabling session/cookie theft or actions in the victim's context. No public exploit code was identified at time of analysis.