The WP Photo Album Plus plugin for WordPress is vulnerable to stored cross‑site scripting because the wppa_user_upload function does not adequately sanitize or escape user input. The flaw permits authenticated users with Subscriber or higher privileges to insert malicious JavaScript into photo album descriptions, which will then execute in the browsers of any user who views the album. This can lead to session hijacking, credential theft, or defacement, and represents a classic client‑side injection (CWE‑79).

The vulnerability affects all versions of the WP Photo Album Plus plugin up to and including 9.0.11.006. The product is distributed by the vendor opajaap under the name WP Photo Album Plus for WordPress. Users running any of those affected releases on their sites are susceptible.

The CVSS v3.1 score for this issue is 5.4, indicating moderate severity. The EPSS score is less than 1%, suggesting that immediate exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to authenticate as a user with Subscriber or higher privileges and use the wppa_user_upload feature to inject JavaScript into photo album descriptions. The stored payload is then delivered to any visitor, enabling client‑side attacks when the album is viewed.