The WP Photo Album Plus WordPress plugin before version 9.2.07.002 contains a reflected cross‑site scripting flaw because it fails to escape the lbstart parameter before injecting it into an inline script block. If an attacker crafts a URL that includes malicious JavaScript in that parameter, any unsuspecting visitor who follows the link can trigger code execution in the context of the site. This compromise can lead to session hijacking, theft of credentials, or site defacement. The vulnerability requires no authentication; it depends solely on a user visiting a specially crafted URL. The reflected payload is executed immediately in the victim’s browser as part of the gallery page, giving the attacker a straightforward injection point. Because this bug allows direct malicious code execution on the client side, it is rated with high severity. The absence of mitigation reporting in the CVE indicates that no active exploitation has been formally documented, but the nature of XSS suggests it would be attractive to attackers, especially if the gallery pages are widely shared.

WordPress plugin WP Photo Album Plus, versions prior to 9.2.07.002. All installations using the affected plugin that expose the lbstart query parameter in gallery pages are vulnerable.

The flaw permits unauthenticated attackers to deliver arbitrary JavaScript to any user who opens a crafted link to a gallery page. The reliance on user interaction only makes the attack condition simple; no privileged access or complex setup is required. While the CVSS score is not provided, reflected XSS typically scores in the high range, and with no current exploitation evidence the EPSS is not available. The vulnerability is not listed in CISA KEV. An attacker could use the injected script to steal session cookies, deface the site, or redirect users to phishing pages.