Description
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can embed the malicious [photo] shortcode in a post submitted for review, causing the stored payload to execute when an administrator or any other user views the post.
Published: 2026-07-01
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WP Photo Album Plus plugin has a stored cross‑site scripting vulnerability (CWE-79) in the ‘subtext’ attribute of the [photo] shortcode. The flaw originates from insufficient input sanitization and output escaping. An authenticated contributor or higher attacker can inject arbitrary JavaScript, causing the malicious code to execute whenever a post containing the injected shortcode is viewed.

Affected Systems

WordPress sites that use the opajaap WP Photo Album Plus plugin at version 9.1.13.005 or earlier are vulnerable to a stored cross‑site scripting flaw.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity. The EPSS score of <1% reflects a very low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires a user with contributor‑level privileges, making the risk contingent on the site's role configuration.

Generated by OpenCVE AI on July 22, 2026 at 14:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the WP Photo Album Plus plugin to the latest released version that includes the subtext sanitization fix.
  • Remove or neutralize existing [photo] shortcodes containing malicious subtext payloads from existing posts.
  • Until a stable update is available, enforce proper input validation and output escaping on the subtext field—strip or escape all JavaScript content before saving.

Generated by OpenCVE AI on July 22, 2026 at 14:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Opajaap
Opajaap wp Photo Album Plus
Wordpress
Wordpress wordpress
Vendors & Products Opajaap
Opajaap wp Photo Album Plus
Wordpress
Wordpress wordpress

Wed, 01 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 10:45:00 +0000

Type Values Removed Values Added
Description The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can embed the malicious [photo] shortcode in a post submitted for review, causing the stored payload to execute when an administrator or any other user views the post.
Title WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Opajaap Wp Photo Album Plus
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-01T12:22:01.471Z

Reserved: 2026-05-29T13:57:08.455Z

Link: CVE-2026-10095

cve-icon Vulnrichment

Updated: 2026-07-01T12:21:57.940Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-22T14:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')