Photo Album Plus CVE-2026-110981

Exploitation requires that a victim first open an attacker-crafted gallery link rendered by the WP Photo Album Plus plugin and THEN click the gallery breadcrumb link, which reflects an unescaped category navigation value into a JavaScript event handler - this two-step user interaction (UI:R) is the primary limiting factor. No authentication or special privileges are needed on the attacker side (PR:N), and the flaw is reachable remotely against the plugin's normal gallery/breadcrumb functionality, so no non-default configuration is indicated by the description. Impact is maximized only when the clicking victim is a logged-in administrator, since the script then executes within a privileged session; targeting an anonymous visitor yields lower impact. Affected deployments are limited to WordPress sites running WP Photo Album Plus prior to version 9.2.11.002.

This is a reflected cross-site scripting (CWE-79) flaw with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector, low complexity, and no-privilege requirements make it easy to reach, but the UI:R metric is decisive: exploitation is not automatic - a victim must follow an attacker-crafted gallery link AND then click the breadcrumb element for the injected handler to fire. The elevated 7.1 score (versus a typical ~6.1 reflected XSS) comes from the Scope:Changed designation reflecting execution in the victim's browser context. Real-world signals are mixed and incomplete: WPScan reports a publicly available proof-of-concept, which raises practical risk, but there is NO CISA KEV listing and NO EPSS score was supplied, so there is no evidence of active or widespread exploitation - POC availability is a distinct signal from in-the-wild use. No SSVC decision data was provided. Net: this is a credible, patchable, moderate-priority web vulnerability whose impact hinges on social-engineering a privileged user (notably a logged-in administrator) into a two-step interaction, rather than a drive-by or wormable issue. Prioritize patching, but it is not an emergency on the level of an unauthenticated RCE.

An attacker crafts a WP Photo Album Plus gallery URL containing a malicious category navigation value that breaks out of the breadcrumb link's JavaScript event handler. The attacker emails or posts this link to site users or administrators; when a logged-in admin opens the gallery and clicks the breadcrumb, the injected script runs in their authenticated session, enabling actions such as session/cookie theft or admin-panel requests. A public proof-of-concept for this flaw has been published by WPScan.