WP
Product
WP Photo Album Plus
10
CVEs
0
On KEV
8.8
Max CVSS
2
New 30D
Severity mix
Critical 0High 6Medium 4Low 0
Watch
Add WP Photo Album Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-92115 | 8.8 | Oct 16 | WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action Affected: through 9.3.02.002 |
| CVE-2026-87909 | 7.5 | Sep 19 | WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection Affected: through 9.2.09.002 |
| CVE-2024-10958 | 7.3 | Nov 10 | WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay Affected: through 8.8.08.007 |
| CVE-2026-96278 | 7.2 | Oct 10 | WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History Affected: through 9.3.03.002 |
| CVE-2026-18579 | 7.2 | Sep 11 | WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting Affected: through 9.2.08.003 |
| CVE-2025-14835 | 7.1 | Jan 7 | WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting Affected: through 9.1.05.008 |
Showing 6