WP Photo Album Plus EUVD-2026-116771

The available description does not name the specific plugin feature, field, or configuration that stores the malicious input - the exact trigger is not described in the available sources. Exploitation is limited by UI:R: a user must visit the page where the stored payload renders for it to execute, so impact depends on a victim (often an admin or site visitor) loading the affected content. The supplied vector lists PR:N (no authentication), but because the injection path is undocumented it cannot be confirmed whether storing the payload requires a low-privilege authenticated role. Affected deployments are any WP Photo Album Plus installation from the earliest versions through 9.3.05.003.

This is a stored cross-site scripting (XSS) flaw (CWE-79) in the WP Photo Album Plus WordPress plugin, rated CVSS 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The network vector, low complexity and PR:N indicate the injection can be reached remotely without authentication per the supplied vector, but UI:R means a victim must load the affected page for the stored payload to fire, and the limited C:L/I:L/A:L impacts reflect browser-context compromise rather than direct server takeover. The scope change (S:C) accounts for the payload executing in victims' browsers outside the vulnerable component. The vuln.today decision label is 'this_week', indicating prompt but not emergency remediation. There is no CISA KEV listing and no EPSS score in the input, so there is no signal of active or widespread exploitation - consistent with a Patchstack-reported plugin XSS that is a genuine but not critical priority. No working exploit code is referenced. Note a common tension for plugin stored XSS: the supplied vector asserts PR:N (unauthenticated), yet the description does not state how the input is stored, so whether injection truly requires no privileges versus a low-privilege contributor role cannot be confirmed from the available data - verify the injection path with the Patchstack advisory.

An attacker submits a crafted payload into a WP Photo Album Plus input field that the plugin stores and later renders without proper neutralization. When an administrator or other user subsequently views the page containing the stored content, the script executes in their browser session. No working exploit code is referenced in the available data.