WP Photo Album Plus contains a stored XSS flaw that allows an attacker to embed malicious scripts inside photo comments. The bug arises because the plugin sanitizes a comment with wp_kses, then passes the result through wp_strip_all_tags, which removes only real tags. A double‑HTML‑entity‑encoded payload such as <img src=… onload=…> passes the sanitization and is stored as a single decoded entity. When viewed by another user, the decoded text becomes a real tag and the malicious script executes in the victim’s browser, potentially hijacking sessions or delivering phishing content. This weakness is a classic input validation issue corresponding to CWE‑79.

All WordPress sites running WP Photo Album Plus version 9.2.03.001 or earlier are affected, regardless of specific configuration. The vulnerability exists whenever the plugin’s comment feature is enabled for any role that can post comments, such as Subscribers. If the plugin is installed and comment posting is allowed, the site is at risk.

The CVSS score of 6.1 indicates moderate‑to‑high severity, and the EPSS score of less than 1 % suggests that the probability of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog, meaning no publicly documented exploits exist yet. However, the attack path is simple: any actor who can submit a comment can inject the malicious payload. High‑traffic sites or those with many Subscriber+ users are therefore more attractive targets because the attacker’s code executes for every visitor who views the infected comment.