WP Photo Album Plus CVE-2026-93774

Requires an attacker to deliver a crafted URL containing an XSS payload to a victim and have that victim click it while the WP Photo Album Plus plugin (<= 9.3.02.002) is installed and active on the target WordPress site; the reflected script then executes in the victim's browser. No authentication is required of the attacker (PR:N), but successful exploitation is limited by mandatory user interaction (UI:R) - the reflected nature means there is no persistent payload, so a per-victim social-engineering step (clicking the malicious link) is the primary limiting factor.

This is a real but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates a network-reachable, low-complexity, unauthenticated reflected Cross-Site Scripting flaw whose exploitation hinges on victim interaction (UI:R) - a user must click an attacker-crafted link. The scope change (S:C) reflects XSS executing in the WordPress admin/user browser context outside the vulnerable component's authorization scope, but the impacts are only Low across confidentiality, integrity, and availability, consistent with typical reflected XSS. Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC referenced (Patchstack advisory is the only source). No SSVC decision data is provided. Note the I/A:L and A:L impacts are somewhat generous for a reflected XSS; I lean toward A:N (~6.1), as reflected XSS rarely affects availability. The realistic risk is moderate-to-low: it is a mass-market WordPress plugin (broad attack surface), but exploitation is gated on social-engineering a victim into clicking a malicious URL, and no automation or active exploitation is evidenced. Fix version is not stated in the input (only the <=9.3.02.002 affected range), which should be verified directly with the vendor/Patchstack advisory before remediation planning.

An attacker crafts a URL to a WordPress site running WP Photo Album Plus <= 9.3.02.002 that embeds a malicious script in an unsanitized, reflected parameter, then lures a logged-in administrator or visitor to click it (e.g., via phishing email or forum link). When the victim opens the link, the script executes in their browser session in the site's context, potentially stealing session cookies, performing actions as the user, or defacing rendered content. No public POC is referenced, and successful exploitation requires the victim to interact with the crafted link.