The WP Photo Album Plus WordPress plugin in versions before 9.2.11.002 fails to properly escape a category navigation value that is reflected into a JavaScript event handler on gallery breadcrumb links. This omission allows an unauthenticated attacker to inject arbitrary JavaScript that runs in the browser of any user who follows a crafted gallery link and then clicks the breadcrumb. Because the script executes with the page’s privileges, it can perform client‑side actions such as displaying unwanted content or interacting with the user session.

WordPress sites using WP Photo Album Plus at any version earlier than 9.2.11.002 are affected. The flaw exists in all prior releases of the plugin, regardless of where the site is hosted, making every WordPress installation that has not applied the 9.2.11.002 release vulnerable.

Exploitation does not require authentication; the attacker must create a link that includes malicious payload embedded in the category parameter and get the victim to visit the URL and click the breadcrumb to trigger the JavaScript. The vulnerability is client‑side, so the impact is limited to the victim’s browser, but arbitrary code execution in that context could lead to cookie theft, session hijacking, or other client‑side compromises. No information is available about existing exploits, EPSS, or KEV inclusion, so the likelihood of exploitation depends on the attacker’s ability to entice or coerce users into following the crafted URL. The CVSS score of 7.1 signals a medium‑to‑high risk to the website’s clients.