Jacob N Breetvelt
Monthly
WP Photo Album Plus versions up to and including 9.3.02.002 contain a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation requires user interaction and results in low confidentiality and integrity impact within the victim's session, potentially enabling cookie theft or content manipulation. Despite a CVSS base score of 7.1, the real-world risk is considered low-priority because the attack is non-persistent and depends on social engineering; no public exploit code or active exploitation has been identified at time of analysis.
Reflected/unauthenticated Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (versions <= 9.2.02.004) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser session when they interact with a crafted link or request. The CVSS 3.1 vector (PR:N, UI:R, S:C) indicates no authentication is required but the victim must be lured into triggering the payload, and the scope change reflects script execution crossing into the WordPress user's authenticated context. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remote attackers inject crafted SQL into a database query, enabling extraction of sensitive data such as user credentials and WordPress secrets. The flaw, reported by Patchstack, is reachable over the network without authentication (CVSS:3.1 PR:N) but carries high attack complexity (AC:H), and there is no public exploit identified at time of analysis. No EPSS score or CISA KEV listing was provided in the source data.
Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. With a CVSS 3.1 score of 9.3 (scope-changed) and no public exploit identified at time of analysis, the flaw exposes WordPress sites running the plugin to database content disclosure and limited integrity/availability impact. Patchstack reported the issue and it carries CWE-89 (SQL Injection).
Authenticated (Subscriber-level) cross-site scripting in WP Photo Album Plus 9.3.02.003 and earlier lets any logged-in user with only Subscriber privileges store script payloads that execute in the browser of a higher-privileged user - typically an administrator - who views the affected page. Because the payload persists in plugin-managed content, the victim must simply load the page (UI:R), and successful execution occurs in the administrator's session context (scope change, S:C), enabling limited confidentiality, integrity, and availability impact. Exploitation requires a valid low-privileged account, so sites with open registration or self-service sign-up are the most exposed; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuine but low-to-moderate priority issue.
WP Photo Album Plus versions up to and including 9.3.02.002 contain a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation requires user interaction and results in low confidentiality and integrity impact within the victim's session, potentially enabling cookie theft or content manipulation. Despite a CVSS base score of 7.1, the real-world risk is considered low-priority because the attack is non-persistent and depends on social engineering; no public exploit code or active exploitation has been identified at time of analysis.
Reflected/unauthenticated Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (versions <= 9.2.02.004) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser session when they interact with a crafted link or request. The CVSS 3.1 vector (PR:N, UI:R, S:C) indicates no authentication is required but the victim must be lured into triggering the payload, and the scope change reflects script execution crossing into the WordPress user's authenticated context. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remote attackers inject crafted SQL into a database query, enabling extraction of sensitive data such as user credentials and WordPress secrets. The flaw, reported by Patchstack, is reachable over the network without authentication (CVSS:3.1 PR:N) but carries high attack complexity (AC:H), and there is no public exploit identified at time of analysis. No EPSS score or CISA KEV listing was provided in the source data.
Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. With a CVSS 3.1 score of 9.3 (scope-changed) and no public exploit identified at time of analysis, the flaw exposes WordPress sites running the plugin to database content disclosure and limited integrity/availability impact. Patchstack reported the issue and it carries CWE-89 (SQL Injection).
Authenticated (Subscriber-level) cross-site scripting in WP Photo Album Plus 9.3.02.003 and earlier lets any logged-in user with only Subscriber privileges store script payloads that execute in the browser of a higher-privileged user - typically an administrator - who views the affected page. Because the payload persists in plugin-managed content, the victim must simply load the page (UI:R), and successful execution occurs in the administrator's session context (scope change, S:C), enabling limited confidentiality, integrity, and availability impact. Exploitation requires a valid low-privileged account, so sites with open registration or self-service sign-up are the most exposed; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuine but low-to-moderate priority issue.