EUVD-2026-75953
GHSA-5mj5-4x3x-pjmq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated nopriv AJAX endpoint (PR:N, AV:N); stored XSS crosses security contexts into victim browser (S:C); limited C/I typical of XSS without privilege escalation chain.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce failure path for the getshortcodedrenderedfenodelay action serves as the log-write trigger rather than an access barrier - a deliberately failed nonce check causes wppa_log() to record the attacker-supplied X-Forwarded-For value to disk, making the exploit fully reachable by unauthenticated callers via the wp_ajax_nopriv_wppa endpoint.
AnalysisAI
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The WordPress site must have the WP Photo Album Plus plugin installed and activated in any version through 9.2.08.003. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) accurately reflects the attack profile: network-accessible, no authentication, no complexity barriers, and scope-changed because the injected script executes in a different security context (the victim's browser). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade WP Photo Album Plus to the version introduced in changeset 3641521 on the WordPress.org plugin SVN trunk, which patches wppa-input.php and wppa-admin-scripts.js (see changesets linked in the Wordfence advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running WP Photo Album Plus through version 9.2.08.003 and document their business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Photo Album Plus
View allUnauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to p
Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unaut
SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject a
Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress us
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Rated medium
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject pers
Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attacker
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remot
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrendere
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today