What is the CVSS score of CVE-2026-17013?

CVE-2026-17013 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 17.0%.

Is there a public PoC exploit available for CVE-2026-17013?

Yes, a public proof-of-concept exploit is available for CVE-2026-17013. Prioritise patching immediately. EPSS: 17.0%.

Is there a patch available for CVE-2026-17013?

Yes, a patch is available for CVE-2026-17013. Update the affected software to the latest version immediately.

WP Photo Album Plus CVE-2026-17013

EUVD-2026-57092 MEDIUM

Improper Authentication (CWE-287)

2026-08-12 WPScan

GHSA-7x94-87h5-h3g2

WordPress XSS Authentication Bypass Wp Photo Album Plus Unknown

6.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS; PR:N as attacker needs no credentials; UI:R as victim must open crafted link; S:C as script executes in victim browser scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 17:27 vuln.today

Patch available

Aug 12, 2026 - 07:16 EUVD

CVE Published

Aug 12, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 12, 2026 - 06:00 cve.org

MEDIUM 6.1

DescriptionCVE.org

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.

AnalysisAI

Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by reflecting an unsanitized parameter directly into an inline script block on gallery pages. Exploitation requires social engineering - the victim must open a crafted link - but no attacker credentials are needed. A publicly available proof-of-concept exists, reported by WPScan, and EPSS places exploitation probability at 17%, a notably elevated figure for a reflected XSS in a plugin.

Technical ContextAI

WP Photo Album Plus is a WordPress plugin that renders photo galleries via front-end page output. The vulnerable code path accepts a URL parameter, fails to sanitize or encode it, and embeds it verbatim inside an inline JavaScript block rendered on gallery-displaying pages. This creates a classic Reflected XSS (CWE-79) condition - though the NVD metadata erroneously lists CWE-287 (Authentication Bypass), which does not match the described behavior. The CPE cpe:2.3:a:unknown:wp_photo_album_plus:*:*:*:*:*:*:*:* reflects the vendor identifier as unresolved in NVD. The CVSS vector S:C (scope changed) is consistent with XSS: the attacker's payload executes inside the victim's browser security context, which is distinct from the server-side vulnerable component.

RemediationAI

Update WP Photo Album Plus to version 9.2.07.002 or later, which is confirmed as the vendor-released patch per the WPScan advisory at https://wpscan.com/vulnerability/1b5b84f0-9e76-47db-9f27-92f6c2ae4f6f/. If immediate patching is not possible, the primary compensating control is to restrict access to gallery-displaying pages to authenticated users only, which would require an attacker to also have valid credentials - raising the effective bar for exploitation. Alternatively, a WAF rule blocking reflected script injection in query parameters (e.g., filtering payloads containing angle brackets or JavaScript event handlers) can reduce exposure, though WAF bypass is always possible against a motivated attacker. Disabling the plugin entirely eliminates the attack surface at the cost of gallery functionality.