WP Photo Album Plus CVE-2026-96278

Exploitation requires the WP Photo Album Plus plugin (<= 9.3.03.002) with its REQUEST_URI session-history logging active and the wppa-modal-container rendering path reachable, so the stored, entity-encoded payload is decoded by wppaEntityDecode() and injected via jQuery .html(). The attacker needs no authentication and no special account, but the script only fires when a user subsequently loads a page that renders the poisoned modal container - that victim page-access is the practical limiting factor, along with the site actually running the affected plugin version. The flaw stems specifically from esc_url_raw() stripping literal angle brackets while retaining HTML entities, so payloads must use entity encoding rather than raw tags.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) indicates a network-reachable, low-complexity, unauthenticated stored XSS with a scope change, which is the standard Wordfence profile for client-side injection in a WordPress plugin. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so there is no evidence of active exploitation or public weaponization; exploitation status is 'no public exploit identified at time of analysis.' The impact is bounded: C:L/I:L/A:N reflects script execution in a victim's browser session rather than server compromise, so this is a moderate client-side risk rather than a server takeover. One signal to verify: the input vector declares UI:N, yet the description says the payload 'will execute whenever a user accesses an injected page,' which implies a victim must visit the poisoned page - a nuance that slightly tempers the 'no interaction' claim but does not change the unauthenticated-injection concern. Overall this is a credible, patch-worthy issue for sites running the affected plugin, but absent KEV/EPSS/POC it is not an emergency relative to actively exploited vulnerabilities.

An unauthenticated attacker crafts a request whose REQUEST_URI contains HTML entities that survive esc_url_raw() sanitization; the plugin stores this in its session history. When a user later triggers the WP Photo Album Plus modal, wppaEntityDecode() converts the entities back into live HTML and jQuery('#wppa-modal-container').html() renders them, executing attacker script in the victim's browser. No public exploit code was identified in the provided data.