The vulnerability is a stored Cross‑Site Scripting flaw due to the plugin’s failure to neutralize user‑supplied input before rendering it on web pages. Attackers can embed malicious scripts that persist in the plugin’s data storage and are then executed automatically in the browsers of any user who visits the affected pages. This can allow an attacker to inject arbitrary client‑side code into the site where the plugin is active. The weakness corresponds to CWE‑79.

The flaw affects the WordPress WP Photo Album Plus plugin from its earliest releases through version 9.3.05.003, provided by Jacob N. Breetvelt. Any WordPress site using this plugin up to and including the listed version is potentially vulnerable; no specific OS or PHP version constraints are indicated in the advisory.

The CVSS score of 7.1 indicates a medium‑to‑high risk level. EPSS information is not available, so the current likelihood of exploitation is unknown. The vulnerability has not been listed in the CISA KEV catalog, indicating that widespread exploitation has not yet been documented. Attackers can exploit the flaw by submitting specially crafted payloads through the plugin’s data entry points, which the plugin stores and renders without sanitization, enabling synchronous execution of the stored scripts on every page view by any user.