WP
Product
WP Photo Album Plus
8
CVEs
0
On KEV
8.8
Max CVSS
2
New 30D
Severity mix
Critical 0High 5Medium 3Low 0
Watch
Add WP Photo Album Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-92115 | 8.8 | Oct 16 | WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action Affected: through 9.3.02.002 |
| CVE-2026-87909 | 7.5 | Sep 19 | WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection Affected: through 9.2.09.002 |
| CVE-2026-96278 | 7.2 | Oct 10 | WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History Affected: through 9.3.03.002 |
| CVE-2026-18579 | 7.2 | Sep 11 | WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting Affected: through 9.2.08.003 |
| CVE-2025-14835 | 7.1 | Jan 7 | WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting Affected: through 9.1.05.008 |
| CVE-2026-10095 | 6.4 | Jul 1 | WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute Affected: through 9.1.13.005 |
| CVE-2025-8726 | 5.4 | Oct 4 | WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload Affected: through 9.0.11.006 |
| CVE-2026-15344 | 4.9 | Jul 29 | WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter Affected: through 9.2.04.002 |
Showing 8