EUVD-2026-51419
GHSA-xmq9-mfwm-hg4m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible stored XSS with scope change into victim browser; PR:N reflects default open-comment configuration; UI:R required as victim must load the page containing the stored payload.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, wppa_do_comment() sanitizes the comment with wppa_filter_html() (wp_kses) followed by wp_strip_all_tags() (wppa-functions.php:2623-2624). Because wp_strip_all_tags() only removes *real* tags, an attacker who submits a double HTML-entity-encoded payload (e.g. &lt;img src=... onload=...&gt;) passes the write filters as harmless entity text and is stored one decode-level down (<img ... onload=...>).
AnalysisAI
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject persistent malicious scripts into photo comments by exploiting a decode-after-sanitize flaw in the plugin's comment pipeline. The sanitization sequence in wppa-functions.php applies wp_kses then wp_strip_all_tags() on write, but neither function decodes HTML entities before inspecting markup - a double-encoded payload such as &lt;script&gt; passes both filters as harmless text, is stored one entity-decode level down, and renders as executable HTML when a victim's browser processes the page. A public proof-of-concept is available via WPScan; however, the vulnerability is not in CISA KEV and EPSS sits at 0.15% (5th percentile), indicating no observed mass exploitation at time of analysis.
Technical ContextAI
WP Photo Album Plus is a PHP-based WordPress plugin providing photo gallery and album management with a user-facing comment system. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the decode-after-sanitize variant: the plugin's wppa_do_comment() function applies two sequential sanitizers at wppa-functions.php:2623-2624 - first wppa_filter_html() (a wrapper around WordPress core's wp_kses) and then wp_strip_all_tags(). Both functions operate on syntactic HTML: wp_kses allows or strips real tags by parsing angle brackets, and wp_strip_all_tags() removes only structurally complete <tag> constructs. Neither performs HTML entity decoding prior to inspection. An attacker supplying &lt;img src=x onerror=...&gt; presents no real angle brackets to either filter; the payload is written to storage as <img src=x onerror=...>. On page render, the browser performs one round of entity decoding, reconstructing a live HTML tag from the stored entity string. CPE: cpe:2.3:a:unknown:wp_photo_album_plus:*:*:*:*:*:*:*:*; affected versions confirmed below 9.2.04.003 per EUVD-2026-51419.
RemediationAI
Update WP Photo Album Plus to version 9.2.04.003 or later, the vendor-released patch that addresses the double-encoding bypass (confirmed by EUVD-2026-51419). Update via the WordPress dashboard under Plugins → Updates, or download the patched release directly from the WordPress plugin repository. If immediate patching is not feasible, disabling the photo commenting feature entirely eliminates the attack write path - this is the most effective compensating control, though it removes commenting functionality for users. A softer alternative is restricting comment submission to authenticated WordPress users (configured under Settings → Discussion → 'Comment author must have a previously approved comment' or by requiring login), which raises the prerequisite from PR:N to PR:L and reduces opportunistic risk, but does not fix the underlying sanitization flaw and may break gallery workflows for public-facing sites. The WPScan advisory at https://wpscan.com/vulnerability/ca9f99eb-221a-417e-b18f-0a8b8b513f2e/ provides additional context.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today