CVE-2021-25115: Wppa Wp Photo Album Plus

Medium severity, CVSS 6.4. EPSS: 0.7% chance of exploitation in the next 30 days.

The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.

Affected products

• Wppa Wp Photo Album Plus: before 8.0.10.006 (fixed in 8.0.10.006)

Published 2022-02-14. Last modified 2026-06-17.