Skip to main content

WP Photo Album Plus CVE-2026-17013

| EUVDEUVD-2026-57092 MEDIUM
Improper Authentication (CWE-287)
2026-08-12 WPScan GHSA-7x94-87h5-h3g2
XSS Authentication Bypass WordPress Wp Photo Album Plus
6.1
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vuln.today AI
6.1 MEDIUM

Network-delivered reflected XSS; PR:N as attacker needs no credentials; UI:R as victim must open crafted link; S:C as script executes in victim browser scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
Analysis Generated
Aug 12, 2026 - 17:27 vuln.today
Patch available
Aug 12, 2026 - 07:16 EUVD
CVE Published
Aug 12, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 12, 2026 - 06:00 cve.org
MEDIUM 6.1

DescriptionCVE.org

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.

AnalysisAI

Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by reflecting an unsanitized parameter directly into an inline script block on gallery pages. Exploitation requires social engineering - the victim must open a crafted link - but no attacker credentials are needed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious URL with XSS payload
Delivery
Deliver link via phishing or social engineering
Exploit
Victim opens gallery page in browser
Execution
Unsanitized parameter reflects into inline script block
Persist
Payload executes in victim browser context
Impact
Session token or credentials exfiltrated to attacker
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication is required from the attacker - the vulnerable parameter is processed on publicly accessible gallery pages without any access control check. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N is textbook for reflected XSS - moderate severity because the scope change elevates impact but user interaction limits automatable mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a URL pointing to any WordPress page displaying a WP Photo Album Plus gallery, appending a malicious value to the vulnerable parameter that injects a JavaScript payload into the inline script block. The attacker then delivers this link via phishing email or social media to a target - ideally a logged-in WordPress administrator. …
Remediation Update WP Photo Album Plus to version 9.2.07.002 or later, which is confirmed as the vendor-released patch per the WPScan advisory at https://wpscan.com/vulnerability/1b5b84f0-9e76-47db-9f27-92f6c2ae4f6f/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wp Photo Album Plus

View all
CVE-2026-18049 HIGH POC
7.5 Aug 12

Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows

CVE-2026-18048 HIGH POC
7.5 Aug 12

Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to p
CVE-2026-6379 HIGH POC
8.6 May 18

SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject a
CVE-2021-25115 MEDIUM POC
6.4 Feb 14

The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Rated medium
CVE-2026-14922 MEDIUM POC
6.1 Jul 31

Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject pers
CVE-2026-39511 CRITICAL
9.3 Jun 15

Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attacker
CVE-2015-3647 MEDIUM POC
4.3 May 21

Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin

CVE-2026-18962 MEDIUM POC
4.3 Aug 12

Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress us
CVE-2026-54829 HIGH
7.5 Jun 25

Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remot
CVE-2024-10958 HIGH
7.3 Nov 10

The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrendere
CVE-2026-57675 HIGH
7.1 Jul 02

Reflected/unauthenticated Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (versions <= 9.2.02.004) lets
CVE-2024-4037 MEDIUM
6.5 May 24

The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and i

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-17013 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy