wp_photo_album_plus vulnerabilities
CVEs whose affected-version data names the wp_photo_album_plus package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-87909High· 7.5The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into a…
▾ Twilightopajaap · WP Photo Album PlusEPSS 0.53%via NVD
CVE-2026-18579High· 7.2WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escapin…
▾ Twilightopajaap · WP Photo Album PlusEPSS 0.29%via CVEORG