WP Photo Album Plus vulnerabilities
8 known vulnerabilities in WP Photo Album Plus from Opajaap. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
WP Photo Album Plus: Improper Neutralization of Special Elements used in a Command
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `w
- 7.2 High severity
WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for un
- 7.5 High severity
WP Photo Album Plus: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command s
- 7.2 High severity
WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possib
- 7.1 High severity
WP Photo Album Plus: Improper Neutralization of Script-Related HTML Tags in a Web Page
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for u
- 7.3 High severity
WP Photo Album Plus: Improper Control of Generation of Code
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to execute an action th
- 7.3 High severity
WP Photo Album Plus: Improper Control of Generation of Code
The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to the plugin allowing unauthenticated users to execute an action that does not properly validate a value
- 10.0 Critical severity
WP Photo Album Plus: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.7.01.001.