EUVD-2026-58595
GHSA-5vqc-rg5p-3cgm
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
WordPress Contributor is a low-privilege authenticated role (PR:L); injected script executes in victim browser beyond plugin scope (S:C); no availability impact applies.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.
AnalysisAI
Stored cross-site scripting in the Embed Google Photos album WordPress plugin (all versions through 2.2.1) allows authenticated Contributor-role users to inject arbitrary JavaScript via an unescaped shortcode attribute rendered directly into an HTML attribute context. The injected script executes silently in the browser of any user who views the affected post, including administrators, enabling session hijacking and potential full site takeover. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects negligible current exploitation activity.
Technical ContextAI
The vulnerability is a stored XSS (CWE-79) rooted in missing output encoding: the plugin renders a user-supplied shortcode attribute value directly into an HTML attribute without escaping double-quotes or other HTML metacharacters, enabling attribute injection and event-handler breakout. In WordPress, shortcodes are processed server-side and their rendered output is persisted in post content, so the payload survives across page loads until explicitly removed. The plugin provides Google Photos album embedding via shortcode and is distinct from WordPress core. The affected scope covers Embed Google Photos album versions 0 through 2.2.1 inclusive, as confirmed by EUVD-2026-58595 and the WPScan advisory.
RemediationAI
No vendor-released patched version has been identified from the available data at time of analysis - patch status should be verified directly against the WordPress plugin repository for a release exceeding version 2.2.1. If an updated version is available, administrators should upgrade immediately. If no patch exists, the safest compensating control is to deactivate and remove the plugin entirely, which eliminates the attack surface at the cost of losing the Google Photos album embedding feature. As an additional measure, restrict Contributor-role self-registration on sites where untrusted users can obtain accounts, since lowering the attacker's entry barrier is the primary amplifying factor for this vulnerability. Existing posts using the plugin's shortcode should be audited for unexpected attribute content. See https://wpscan.com/vulnerability/e8fae1ed-59a0-4e64-b82d-26328f460cad/ and https://nvd.nist.gov/vuln/detail/CVE-2026-14290 for advisory updates.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today