Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:wppa:wp_photo_album_plus:*:*:*:*:*:wordpress:*:*

3 briefs RSS
high advisory

Authenticated Command Injection in WP Photo Album Plus

Authenticated users with specific plugin privileges can achieve remote code execution in WP Photo Album Plus via command injection in the update-photo AJAX action.

WP Photo Album Plus
1r 2t 1c
high advisory

Remote Code Execution in WP Photo Album Plus Plugin

The WP Photo Album Plus plugin for WordPress contains an RCE vulnerability (CVE-2026-87909) allowing authenticated attackers with subscriber-level access to execute arbitrary commands through improper sanitization of ImageMagick arguments.

WP Photo Album Plus
2t 1c
high advisory

Stored XSS Vulnerability in WP Photo Album Plus Plugin

An unauthenticated stored XSS vulnerability in WP Photo Album Plus versions 9.2.08.003 and earlier allows attackers to inject malicious scripts via the HTTP_X_FORWARDED_FOR header, which is logged without sanitization.

WP Photo Album Plus web-application xss wordpress
1r 2t 1c