Wp Photo Album Plus
Monthly
Reflected cross-site scripting in WP Photo Album Plus before 9.2.11.002 allows remote unauthenticated attackers to inject script through a category navigation value that is reflected into a JavaScript event handler on gallery breadcrumb links. The victim must first open a crafted gallery link and then click the breadcrumb, so exploitation depends on that two-step user interaction; targeting a logged-in administrator yields script execution in a privileged session. Publicly available exploit code exists, and the vendor has released a patched version, 9.2.11.002.
Authenticated OS command injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.3.02.002) lets any WordPress user granted the plugin-defined wppa_upload capability execute arbitrary operating-system commands as the web-server user, achieving full server-side code execution where ImageMagick is the active image backend. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is reachable through the update-photo AJAX action's value parameter, and no public exploit code was identified at time of analysis; the bug is not in CISA KEV. Because wppa_upload is a plugin-level privilege that administrators can delegate to lower-privileged roles, the effective attacker pool can extend well beyond site administrators on misconfigured sites.
Stored cross-site scripting in the WP Photo Album Plus WordPress plugin affects all versions up to and including 9.3.03.002 and can be triggered by remote attackers without authentication, since the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N. The plugin records session history derived from REQUEST_URI without adequate sanitization, and because esc_url_raw() strips literal angle brackets while preserving HTML entities, the plugin's own wppaEntityDecode() routine later converts those entities back into live markup that is rendered through jQuery('#wppa-modal-container').html(). The stored script executes only when a victim subsequently loads a page that renders the poisoned modal container, which is the practical limiting factor; the base score of 7.2 (HIGH) reflects scope change with limited confidentiality and integrity impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
WP Photo Album Plus versions up to and including 9.3.02.002 contain a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation requires user interaction and results in low confidentiality and integrity impact within the victim's session, potentially enabling cookie theft or content manipulation. Despite a CVSS base score of 7.1, the real-world risk is considered low-priority because the attack is non-persistent and depends on social engineering; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in WP Photo Album Plus affects all versions through the wppa_image_magick path, allowing authenticated attackers with subscriber-level access and above to run server-side code when the site uses ImageMagick processing. The issue is argument injection into an ImageMagick command executed via PHP exec(), enabled by insufficient sanitization of the multipart upload filename and reliance on escapeshellcmd() instead of proper argument quoting. Exploitation requires ImageMagick to be available and the plugin to route uploads through ImageMagick rather than GD, and no public exploit was identified at time of analysis; CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. No public exploit or KEV listing has been identified at time of analysis, but the technique (header spoofing against a nopriv AJAX endpoint) is trivially automatable.
Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows any remote attacker to read arbitrary autoloaded WordPress option values by supplying a crafted suffix to a public, unprotected endpoint. The plugin constructs an option name from client-controlled input without restricting it to its own namespace or verifying any capability or nonce, exposing site-wide secrets stored in wp_options. A publicly available proof-of-concept exists, SSVC rates this as automatable with partial technical impact, and EPSS sits at 16%, indicating meaningful real-world exploitation interest despite the absence of a CISA KEV listing.
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to path traversal attacks through a public endpoint that accepts unvalidated client-controlled file path values with no authorization check in place. Any remote unauthenticated attacker can manipulate this path parameter to target and delete ZIP archives stored anywhere on the server, including directories outside the web root. A publicly available proof-of-concept exists, EPSS scores this at 16%, and no public exploit identified at time of analysis maps to confirmed mass exploitation - but the low attack complexity and zero authentication barrier make rapid weaponization realistic.
Reflected/unauthenticated Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (versions <= 9.2.02.004) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser session when they interact with a crafted link or request. The CVSS 3.1 vector (PR:N, UI:R, S:C) indicates no authentication is required but the victim must be lured into triggering the payload, and the scope change reflects script execution crossing into the WordPress user's authenticated context. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remote attackers inject crafted SQL into a database query, enabling extraction of sensitive data such as user credentials and WordPress secrets. The flaw, reported by Patchstack, is reachable over the network without authentication (CVSS:3.1 PR:N) but carries high attack complexity (AC:H), and there is no public exploit identified at time of analysis. No EPSS score or CISA KEV listing was provided in the source data.
Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. With a CVSS 3.1 score of 9.3 (scope-changed) and no public exploit identified at time of analysis, the flaw exposes WordPress sites running the plugin to database content disclosure and limited integrity/availability impact. Patchstack reported the issue and it carries CWE-89 (SQL Injection).
SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitized parameter, exposing backend database contents such as user credentials and hashed passwords. The CVSS vector (PR:N, S:C, C:H) indicates no authentication is required and that a successful attack reaches data beyond the plugin's own scope. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though the EPSS score is very low at 0.04% (14th percentile).
Authenticated (Subscriber-level) cross-site scripting in WP Photo Album Plus 9.3.02.003 and earlier lets any logged-in user with only Subscriber privileges store script payloads that execute in the browser of a higher-privileged user - typically an administrator - who views the affected page. Because the payload persists in plugin-managed content, the victim must simply load the page (UI:R), and successful execution occurs in the administrator's session context (scope change, S:C), enabling limited confidentiality, integrity, and availability impact. Exploitation requires a valid low-privileged account, so sites with open registration or self-service sign-up are the most exposed; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuine but low-to-moderate priority issue.
Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress user-including low-privilege Subscriber accounts-to upload files into photo albums owned by other users or administrators. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's front-end upload endpoint accepts a caller-supplied album identifier without verifying ownership, enabling cross-user content injection. A publicly available POC exists via WPScan; no active exploitation is confirmed in CISA KEV, and the attack surface is constrained by a non-default configuration prerequisite.
Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by reflecting an unsanitized parameter directly into an inline script block on gallery pages. Exploitation requires social engineering - the victim must open a crafted link - but no attacker credentials are needed. A publicly available proof-of-concept exists, reported by WPScan, and EPSS places exploitation probability at 17%, a notably elevated figure for a reflected XSS in a plugin.
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject persistent malicious scripts into photo comments by exploiting a decode-after-sanitize flaw in the plugin's comment pipeline. The sanitization sequence in `wppa-functions.php` applies `wp_kses` then `wp_strip_all_tags()` on write, but neither function decodes HTML entities before inspecting markup - a double-encoded payload such as `&lt;script&gt;` passes both filters as harmless text, is stored one entity-decode level down, and renders as executable HTML when a victim's browser processes the page. A public proof-of-concept is available via WPScan; however, the vulnerability is not in CISA KEV and EPSS sits at 0.15% (5th percentile), indicating no observed mass exploitation at time of analysis.
Information disclosure via SQL injection in the WP Photo Album Plus plugin for WordPress allows authenticated administrator-level users to extract sensitive database content. All versions up to 9.2.04.002 are vulnerable due to insufficient escaping and lack of prepared statements on the 'table' parameter. The missing nonce check on the export-table endpoint also enables CSRF exploitation, reducing the practical barrier for data theft.
Stored Cross-Site Scripting in WP Photo Album Plus (WordPress plugin, all versions through 9.1.13.005) allows contributor-level authenticated attackers to inject persistent JavaScript payloads via the unsanitized 'subtext' parameter of the [photo] shortcode. The CVSS scope change (S:C) is the critical amplifier: a low-privileged contributor can embed malicious shortcodes in posts submitted for editorial review, causing the stored payload to execute in administrator browser sessions when the content is previewed - enabling session hijacking and potential full site takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and common WordPress contributor registration practices make this a realistic threat on affected installations.
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Authorization Bypass Through User-Controlled Key vulnerability in J.N. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N.
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote attackers to inject arbitrary web. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Reflected cross-site scripting in WP Photo Album Plus before 9.2.11.002 allows remote unauthenticated attackers to inject script through a category navigation value that is reflected into a JavaScript event handler on gallery breadcrumb links. The victim must first open a crafted gallery link and then click the breadcrumb, so exploitation depends on that two-step user interaction; targeting a logged-in administrator yields script execution in a privileged session. Publicly available exploit code exists, and the vendor has released a patched version, 9.2.11.002.
Authenticated OS command injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.3.02.002) lets any WordPress user granted the plugin-defined wppa_upload capability execute arbitrary operating-system commands as the web-server user, achieving full server-side code execution where ImageMagick is the active image backend. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is reachable through the update-photo AJAX action's value parameter, and no public exploit code was identified at time of analysis; the bug is not in CISA KEV. Because wppa_upload is a plugin-level privilege that administrators can delegate to lower-privileged roles, the effective attacker pool can extend well beyond site administrators on misconfigured sites.
Stored cross-site scripting in the WP Photo Album Plus WordPress plugin affects all versions up to and including 9.3.03.002 and can be triggered by remote attackers without authentication, since the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N. The plugin records session history derived from REQUEST_URI without adequate sanitization, and because esc_url_raw() strips literal angle brackets while preserving HTML entities, the plugin's own wppaEntityDecode() routine later converts those entities back into live markup that is rendered through jQuery('#wppa-modal-container').html(). The stored script executes only when a victim subsequently loads a page that renders the poisoned modal container, which is the practical limiting factor; the base score of 7.2 (HIGH) reflects scope change with limited confidentiality and integrity impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
WP Photo Album Plus versions up to and including 9.3.02.002 contain a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation requires user interaction and results in low confidentiality and integrity impact within the victim's session, potentially enabling cookie theft or content manipulation. Despite a CVSS base score of 7.1, the real-world risk is considered low-priority because the attack is non-persistent and depends on social engineering; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in WP Photo Album Plus affects all versions through the wppa_image_magick path, allowing authenticated attackers with subscriber-level access and above to run server-side code when the site uses ImageMagick processing. The issue is argument injection into an ImageMagick command executed via PHP exec(), enabled by insufficient sanitization of the multipart upload filename and reliance on escapeshellcmd() instead of proper argument quoting. Exploitation requires ImageMagick to be available and the plugin to route uploads through ImageMagick rather than GD, and no public exploit was identified at time of analysis; CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. No public exploit or KEV listing has been identified at time of analysis, but the technique (header spoofing against a nopriv AJAX endpoint) is trivially automatable.
Unauthenticated information disclosure in WP Photo Album Plus (WordPress plugin, all versions before 9.2.07.002) allows any remote attacker to read arbitrary autoloaded WordPress option values by supplying a crafted suffix to a public, unprotected endpoint. The plugin constructs an option name from client-controlled input without restricting it to its own namespace or verifying any capability or nonce, exposing site-wide secrets stored in wp_options. A publicly available proof-of-concept exists, SSVC rates this as automatable with partial technical impact, and EPSS sits at 16%, indicating meaningful real-world exploitation interest despite the absence of a CISA KEV listing.
Unauthenticated arbitrary file deletion in WP Photo Album Plus (versions before 9.2.07.002) exposes WordPress sites to path traversal attacks through a public endpoint that accepts unvalidated client-controlled file path values with no authorization check in place. Any remote unauthenticated attacker can manipulate this path parameter to target and delete ZIP archives stored anywhere on the server, including directories outside the web root. A publicly available proof-of-concept exists, EPSS scores this at 16%, and no public exploit identified at time of analysis maps to confirmed mass exploitation - but the low attack complexity and zero authentication barrier make rapid weaponization realistic.
Reflected/unauthenticated Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (versions <= 9.2.02.004) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser session when they interact with a crafted link or request. The CVSS 3.1 vector (PR:N, UI:R, S:C) indicates no authentication is required but the victim must be lured into triggering the payload, and the scope change reflects script execution crossing into the WordPress user's authenticated context. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Blind SQL injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.1.13.005) lets remote attackers inject crafted SQL into a database query, enabling extraction of sensitive data such as user credentials and WordPress secrets. The flaw, reported by Patchstack, is reachable over the network without authentication (CVSS:3.1 PR:N) but carries high attack complexity (AC:H), and there is no public exploit identified at time of analysis. No EPSS score or CISA KEV listing was provided in the source data.
Unauthenticated SQL injection in the WP Photo Album Plus WordPress plugin (versions ≤ 9.1.08.001) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. With a CVSS 3.1 score of 9.3 (scope-changed) and no public exploit identified at time of analysis, the flaw exposes WordPress sites running the plugin to database content disclosure and limited integrity/availability impact. Patchstack reported the issue and it carries CWE-89 (SQL Injection).
SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitized parameter, exposing backend database contents such as user credentials and hashed passwords. The CVSS vector (PR:N, S:C, C:H) indicates no authentication is required and that a successful attack reaches data beyond the plugin's own scope. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though the EPSS score is very low at 0.04% (14th percentile).
Authenticated (Subscriber-level) cross-site scripting in WP Photo Album Plus 9.3.02.003 and earlier lets any logged-in user with only Subscriber privileges store script payloads that execute in the browser of a higher-privileged user - typically an administrator - who views the affected page. Because the payload persists in plugin-managed content, the victim must simply load the page (UI:R), and successful execution occurs in the administrator's session context (scope change, S:C), enabling limited confidentiality, integrity, and availability impact. Exploitation requires a valid low-privileged account, so sites with open registration or self-service sign-up are the most exposed; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a genuine but low-to-moderate priority issue.
Insufficient authorization in WP Photo Album Plus (all versions before 9.2.09.002) allows any authenticated WordPress user-including low-privilege Subscriber accounts-to upload files into photo albums owned by other users or administrators. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's front-end upload endpoint accepts a caller-supplied album identifier without verifying ownership, enabling cross-user content injection. A publicly available POC exists via WPScan; no active exploitation is confirmed in CISA KEV, and the attack surface is constrained by a non-default configuration prerequisite.
Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by reflecting an unsanitized parameter directly into an inline script block on gallery pages. Exploitation requires social engineering - the victim must open a crafted link - but no attacker credentials are needed. A publicly available proof-of-concept exists, reported by WPScan, and EPSS places exploitation probability at 17%, a notably elevated figure for a reflected XSS in a plugin.
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject persistent malicious scripts into photo comments by exploiting a decode-after-sanitize flaw in the plugin's comment pipeline. The sanitization sequence in `wppa-functions.php` applies `wp_kses` then `wp_strip_all_tags()` on write, but neither function decodes HTML entities before inspecting markup - a double-encoded payload such as `&lt;script&gt;` passes both filters as harmless text, is stored one entity-decode level down, and renders as executable HTML when a victim's browser processes the page. A public proof-of-concept is available via WPScan; however, the vulnerability is not in CISA KEV and EPSS sits at 0.15% (5th percentile), indicating no observed mass exploitation at time of analysis.
Information disclosure via SQL injection in the WP Photo Album Plus plugin for WordPress allows authenticated administrator-level users to extract sensitive database content. All versions up to 9.2.04.002 are vulnerable due to insufficient escaping and lack of prepared statements on the 'table' parameter. The missing nonce check on the export-table endpoint also enables CSRF exploitation, reducing the practical barrier for data theft.
Stored Cross-Site Scripting in WP Photo Album Plus (WordPress plugin, all versions through 9.1.13.005) allows contributor-level authenticated attackers to inject persistent JavaScript payloads via the unsanitized 'subtext' parameter of the [photo] shortcode. The CVSS scope change (S:C) is the critical amplifier: a low-privileged contributor can embed malicious shortcodes in posts submitted for editorial review, causing the stored payload to execute in administrator browser sessions when the content is previewed - enabling session hijacking and potential full site takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and common WordPress contributor registration practices make this a realistic threat on affected installations.
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Authorization Bypass Through User-Controlled Key vulnerability in J.N. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N.
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote attackers to inject arbitrary web. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.