WP Photo Album Plus vulnerabilities
We track 4 vulnerabilities in WP Photo Album Plus products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 18, 2026.
Latest WP Photo Album Plus vulnerabilities
- 7.1 High severity
WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script
- 7.5 High severity
WP Photo Album Plus: Exposure of Sensitive Information to an Unauthorized Actor
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthent
- 7.5 High severity
WP Photo Album Plus: External Control of File Name or Path
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbi
- 8.6 High severity
WP Photo Album Plus: Improper Neutralization of Special Elements used in an SQL Command
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.