CVE-2026-14922
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WP Photo Album Plus plugin up to version 9.2.03.001 is vulnerable to stored Cross-Site Scripting (XSS) due to a double-encoding flaw in the photo comment pipeline. An attacker can submit a double HTML-entity-encoded payload (e.g., <img src=... onload=...>) that passes filters and is stored, then executes in the victim's browser.
Risk Assessment
Attackers can inject malicious JavaScript that executes in visitors' browsers, leading to session theft, redirects, or other harmful actions.
Recommendation
Update the WP Photo Album Plus plugin to a version later than 9.2.03.001 that fixes the double-encoding issue.
Other vulnerabilities in WP Photo Album Plus WordPress plugin
See all- CVE-2026-6379High
The WP Photo Album Plus WordPress plugin before version 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- CVE-2026-17014Medium
The WP Photo Album Plus WordPress plugin before version 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.
Original NVD description (English source)
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `&lt;img src=... onload=...&gt;`) passes the write filters as harmless entity text and is stored one decode-level down (`<img ... onload=...>`).