Description

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-12T06:19:18.297Z",
  "pubdate": "2026-08-12T06:19:18.297Z",
  "executiveSummary": "An unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability exists in the WP Photo Album Plus WordPress plugin before version 9.2.07.002.\nThe flaw arises due to the lack of proper input sanitization and output escaping on an unvalidated parameter before it is dynamically reflected into an inline script block within the application's response.\nSuccessful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary JavaScript code in the context of a victim's browser session.\nThis occurs when a target user is socially engineered into clicking a specially crafted malicious link pointing to a page displaying a plugin gallery.\nThe resulting impact includes potential session hijacking, theft of sensitive user data, and unauthorized actions performed on behalf of the authenticated user within the WordPress environment.\nThe attack requires network access and user interaction via a crafted URL, presenting a significant risk to site visitors and administrators alike.",
  "technicalDetails": "The vulnerability is rooted in the insecure handling of user-supplied input parameters processed by the WP Photo Album Plus WordPress plugin prior to version 9.2.07.002.\nSpecifically, the vulnerable component fails to execute proper output encoding or context-aware sanitization before embedding parameter values directly into an inline JavaScript execution context within the rendered Hypertext Markup Language (HTML) document.\nBecause the input is reflected directly into an inline script block without validation, an attacker can inject arbitrary script payloads designed to break out of the intended string or execution structure.\nThe attack vector is network-based and relies on HTTP GET requests containing the malicious payload embedded within the vulnerable parameter of a crafted URL.\nExploitation requires no prior authentication or administrative privileges, meaning any external threat actor can target the application.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a malicious Uniform Resource Locator (URL) targeting a legitimate page hosting a WP Photo Album Plus gallery, appending an exploit payload to the vulnerable parameter. Second, the attacker induces a victim—such as an authenticated site administrator or standard subscriber—to click and open the crafted link via phishing or other social engineering vectors. Third, the WordPress site processes the incoming HTTP request, retrieves the unsanitized parameter, and dynamically injects the payload directly into the inline script block of the response page. Fourth, the victim's web browser parses the response, evaluates the malicious script block, and executes the arbitrary JavaScript within the security context of the target origin. Finally, the malicious script can leverage this context to access Document Object Model (DOM) elements, extract session cookies, or perform unauthorized administrative actions via Asynchronous JavaScript and XML (AJAX) calls."
}