Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-photo-album-plus
wp-photo-album-plus
32 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 18, 2026WP Photo Album Plus: Does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb linksCVE-2026-110981 · fixed in 9.2.11.002 · reported by WPScanHigh 7.1
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
Oct 16, 2026WP Photo Album Plus: Authenticated Command InjectionCVE-2026-92115 · affects up to 9.3.02.002 · reported by WordfenceHigh 8.8
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers
Oct 10, 2026WP Photo Album Plus: Stored Cross-Site ScriptingCVE-2026-96278 · affects up to 9.3.03.002 · reported by WordfenceHigh 7.2
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because esc_url_raw() strips literal angle brackets but retains HTML entities, which wppaEntityDecode() silently converts back to live HTML tags before jQuery('#wppa-modal-container').html() renders them.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.CVE-2026-102386 · affects up to 9.3.02.003 · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.CVE-2026-93774 · affects up to 9.3.02.002 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
Sep 18, 2026WP Photo Album Plus: Remote Code ExecutionCVE-2026-87909 · reported by WordfenceHigh 7.5
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and the filename sanitization applied at the database layer is never applied to the physical temporary file path used for ImageMagick processing.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026WP Photo Album Plus: Stored Cross-Site ScriptingCVE-2026-18579 · affects up to 9.2.08.003 · reported by WordfenceHigh 7.2
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce failure path for the getshortcodedrenderedfenodelay action serves as the log-write trigger rather than an access barrier — a deliberately failed nonce check causes wppa_log() to record the attacker-supplied X-Forwarded-For value to disk, making the exploit fully reachable by unauthenticated callers via the wp_ajax_nopriv_wppa endpoint.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 12, 2026WP Photo Album Plus: Does not check that the current user is allowed to upload into the album they targetCVE-2026-18962 · fixed in 9.2.09.002 · reported by WPScanMedium 4.3
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.
Aug 12, 2026WP Photo Album Plus: Does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own optionsCVE-2026-18049 · fixed in 9.2.07.002 · reported by WPScanHigh 7.5
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
Aug 12, 2026WP Photo Album Plus: Does not validate a client-controlled value used to build a file path in one of its public endpoint actionsCVE-2026-18048 · fixed in 9.2.07.002 · reported by WPScanHigh 7.5
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
Aug 12, 2026WP Photo Album Plus: Does not sanitise and escape a parameter before reflecting it into an inline script blockCVE-2026-17013 · fixed in 9.2.07.002 · reported by WPScanMedium 6.1
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.
Aug 9, 2026WP Photo Album Plus: Does not perform any capability or nonce check on one of its public REST endpoint actionsCVE-2026-17014 · fixed in 9.2.07.002 · reported by WPScanMedium 5.3
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.
Jul 29, 2026WP Photo Album Plus: Generic SQL InjectionCVE-2026-15344 · affects up to 9.2.04.002 · reported by WordfenceMedium 4.9
The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The export-table endpoint lacks a nonce check, meaning this vulnerability can also be triggered via CSRF by tricking an authenticated administrator into visiting a malicious page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.CVE-2026-57675 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.
Jul 1, 2026WP Photo Album Plus: Stored Cross-Site ScriptingCVE-2026-10095 · affects up to 9.1.13.005 · reported by WordfenceMedium 6.4
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can embed the malicious [photo] shortcode in a post submitted for review, causing the stored payload to execute when an administrator or any other user views the post.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 25, 2026WP Photo Album Plus: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-54829 · affects up to 9.1.13.005 · reported by PatchstackHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.
Jun 15, 2026Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.CVE-2026-39511 · affects up to 9.1.08.001 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.
May 18, 2026WP Photo Album Plus: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-6379 · fixed in 9.1.11.001 · reported by WPScanHigh 8.6
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Jan 7, 2026WP Photo Album Plus: Reflected Cross-Site ScriptingCVE-2025-14835 · affects up to 9.1.05.008 · reported by WordfenceHigh 7.1
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2025WP Photo Album Plus: Cross-Site ScriptingCVE-2025-8726 · affects up to 9.0.11.006 · reported by WordfenceMedium 5.4
The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppa_user_upload function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in the photo album descriptions that execute in a victim's browser.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 10, 2024The WP Photo Album Plus: Arbitrary shortcode executionCVE-2024-10958 · affects up to 8.8.08.007 · reported by WordfenceHigh 7.3
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 17, 2024WP Photo Album Plus: Reflected Cross-Site ScriptingCVE-2024-9951 · affects up to 8.8.05.003 · reported by WordfenceMedium 6.1
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including, 8.8.05.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Jul 22, 2024WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37416 · affects up to 8.8.00.002 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.00.002.
Jul 20, 2024WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38713 · affects up to 8.8.02.002 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.02.002.
Jun 4, 2024WP Photo Album Plus: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49774 · affects up to 8.5.02.005 · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
May 24, 2024WP Photo Album Plus: Arbitrary shortcode executionCVE-2024-4037 · affects up to 8.7.02.003 · reported by WordfenceMedium 6.5
The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to the plugin allowing unauthenticated users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 14, 2024WP Photo Album Plus: Unrestricted Upload of File with Dangerous TypeCVE-2024-31377 · affects up to 8.7.01.001 · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.7.01.001.
Apr 7, 2024WP Photo Album Plus: Unrestricted Upload of File with Dangerous TypeCVE-2024-31286 · fixed in 8.6.03.005 · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a before 8.6.03.005.
Dec 19, 2023WP Photo Album Plus: Authorization Bypass Through User-Controlled KeyCVE-2023-49812 · affects up to 8.5.02.005 · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
Dec 14, 2023WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49813 · affects up to 8.5.02.005 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
Feb 14, 2022WP Photo Album Plus: Was vulnerable to Stored Cross-Site Scripting (XSS)CVE-2021-25115 · fixed in 8.0.10 · reported by WPScanMedium 6.4
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.
May 21, 2015Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote CVE-2015-3647 · fixed in 6.1.3 · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) comemail or (2) comname parameter in a wppa do-comment action.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.