OP
Vendor
opajaap
8
CVEs
0
On KEV
2
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-92115 | WP WP Photo Album Plus opajaap | 8.8 | Oct 16 | WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action |
| CVE-2026-96278 | WP WP Photo Album Plus opajaap | 7.2 | Oct 10 | WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History |
| CVE-2026-87909 | WP WP Photo Album Plus opajaap | 7.5 | Sep 19 | WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection |
| CVE-2026-18579 | WP WP Photo Album Plus opajaap | 7.2 | Sep 11 | WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2026-15344 | WP WP Photo Album Plus opajaap | 4.9 | Jul 29 | WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter |
| CVE-2026-10095 | WP WP Photo Album Plus opajaap | 6.4 | Jul 1 | WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute |
| CVE-2025-14835 | WP WP Photo Album Plus opajaap | 7.1 | Jan 7 | WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting |
| CVE-2025-8726 | WP WP Photo Album Plus opajaap | 5.4 | Oct 4 | WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload |