What is the CVSS score of EUVD-2026-41286?

EUVD-2026-41286 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP Photo Album Plus are affected by EUVD-2026-41286?

WP Photo Album Plus plugin (versions ≤ 9.2.02.004) contains a web-based vulnerability allowing attackers to compromise WordPress user accounts through specially crafted links, enabling account…

How to fix or mitigate EUVD-2026-41286?

Within 24 hours: Identify and disable WP Photo Album Plus plugin on all WordPress installations. Within 7 days: Completely uninstall the plugin; deploy Web Application Firewall (WAF) rules blocking XSS payloads targeting album endpoints. Within 30 days: Implement Content Security Policy (CSP) headers, audit WordPress session logs for unauthorized access indicators, and confirm all systems are remediated.

WP Photo Album Plus EUVD-2026-41286

| CVE-2026-57675 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-q6wq-9wp2-44h8

WordPress XSS Wp Photo Album Plus Wordpress Plugin Jacob N Breetvelt

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated reflected XSS reachable over the network (AV:N/PR:N) but needs victim interaction (UI:R); script escaping into the user context is a scope change (S:C) with low C/I impact and no genuine availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:27 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.

AnalysisAI

Reflected/unauthenticated Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (versions <= 9.2.02.004) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser session when they interact with a crafted link or request. The CVSS 3.1 vector (PR:N, UI:R, S:C) indicates no authentication is required but the victim must be lured into triggering the payload, and the scope change reflects script execution crossing into the WordPress user's authenticated context. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

WP Photo Album Plus is a WordPress plugin (vendor/author Jacob N. Breetvelt, CPE cpe:2.3:a:jacob_n._breetvelt:wp_photo_album_plus) that adds photo gallery and album management features to WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is echoed into an HTML response without adequate output encoding or input sanitization. Because the plugin runs inside the WordPress request lifecycle and renders in the site's DOM, injected script executes with the privileges and same-origin context of whoever views the affected page, which is why the CVSS scope is marked Changed (S:C).

RemediationAI

No vendor-released patch version was identified in the provided input; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-2-02-004-cross-site-scripting-xss-vulnerability) and the plugin's WordPress.org changelog for a release above 9.2.02.004, then upgrade to that fixed version once confirmed. Until a patched release is verified, apply compensating controls: place the site behind a WAF (such as Patchstack, Wordfence, or Cloudflare) with a rule to strip or block script-like payloads in requests to the plugin's endpoints, which may cause false positives on legitimate gallery parameters; restrict access to WordPress admin pages via IP allowlisting to reduce the chance an authenticated admin triggers the payload; and add a strict Content-Security-Policy that disallows inline script, which mitigates injected scripts but can break themes/plugins that rely on inline JavaScript. If the plugin is not essential, deactivating and removing it eliminates the exposure entirely at the cost of losing gallery functionality.