CVE-2025-14835High· 7.1▾ Twilight

The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score39/ 100 · Low

impact 39.1 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jan 7, 2026

Updated

Sep 30, 2026

CVSS

7.1

Vendor

—

Product

—

CWE

CWE-80

Depth score

39 · Low

EPSS

0.27% · p18

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 266 days

Jan 7, 2026Published
Disclosed via NVD
Sep 30, 2026Record revised
Last analysed / modified upstream
Sep 30, 2026EPSS first tracked
0.3%

CWE-80 #nvd

Full technical detail▾

Overview

The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd