Unknown Wp Photo Album Plus vulnerabilities

8 CVEs affecting Unknown Wp Photo Album Plus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-110981, published 2026-10-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-6379, published 2026-05-18. High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days. The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection…
CVE-2026-18049, published 2026-08-12. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value…
CVE-2026-18048, published 2026-08-12. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation…
CVE-2026-17014, published 2026-08-09. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the…
CVE-2026-17013, published 2026-08-12. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to…
CVE-2026-18962, published 2026-08-12. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any…
CVE-2026-14922, published 2026-07-31. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline.…
CVE-2026-110981, published 2026-10-18. The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links,…