WP
Product
WP Photo Album Plus
9
CVEs
0
On KEV
8.6
Max CVSS
2
New 30D
Severity mix
Critical 0High 4Medium 5Low 0
Watch
Add WP Photo Album Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6379 | 8.6 | May 18 | WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter Affected: before 9.1.11.001 |
| CVE-2026-18049 | 7.5 | Aug 12 | WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo Affected: before 9.2.07.002 |
| CVE-2026-18048 | 7.5 | Aug 12 | WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal Affected: before 9.2.07.002 |
| CVE-2026-110981 | 7.1 | Oct 18 | WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter Affected: before 9.2.11.002 |
| CVE-2026-17013 | 6.1 | Aug 12 | WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart Affected: before 9.2.07.002 |
| CVE-2026-14922 | 6.1 | Jul 31 | WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment Affected: before 9.2.04.003 |
| CVE-2026-17014 | 5.3 | Aug 9 | WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips Affected: before 9.2.07.002 |
| CVE-2026-110983 New | 4.3 | Oct 29 | WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF Affected: before 9.3.04.004 |
| CVE-2026-18962 | 4.3 | Aug 12 | WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization Affected: before 9.2.09.002 |
Showing 9