VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

WP Photo Album Plus security & vulnerabilities

wp-photo-album-plus— active installsLast vulnerability Nov 2, 2026

No known unpatched vulnerabilities in the latest version

All 39 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
39Known vulnerabilities
  • Critical4
  • High14
  • Medium21
  • Low0
Vulnerabilities per year
2008: 1 vulnerability1082013: 1 vulnerability1132014: 2 vulnerabilities2142015: 1 vulnerability1152022: 1 vulnerability1222023: 3 vulnerabilities3232024: 7 vulnerabilities7242025: 1 vulnerability1252026: 22 vulnerabilities2226

All WP Photo Album Plus vulnerabilities

WP Photo Album Plus vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting
≤9.3.05.003Update to 9.3.06.001
CVE-2026-119477
Medium4.3Cross-Site Request Forgery
≤9.3.04.3Update to 9.3.04.004
CVE-2026-110983
Medium6.1Reflected Cross-Site Scripting
≤9.2.11.1Update to 9.2.11.002
CVE-2026-110981
High8.8Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action
≤9.3.02.002Update to 9.3.02.003
CVE-2026-92115
High7.2Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
≤9.3.03.002Update to 9.3.03.003
CVE-2026-96278
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤9.3.02.003Update to 9.3.03.002
CVE-2026-102386
High7.2Unauthenticated Stored Cross-Site Scripting
≤9.3.02.002Update to 9.3.02.003
CVE-2026-93774
High7.5Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
≤9.2.09.002Update to 9.3.01.003
CVE-2026-87909
High7.2Unauthenticated Stored Cross-Site Scripting
≤9.2.08.003Update to 9.2.10.001
CVE-2026-18579
Medium5.3Missing Authorization
<9.2.07.002Update to 9.2.07.002
CVE-2026-18049
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
<9.2.04.003Update to 9.2.04.003
CVE-2026-14922
Medium6.1Reflected Cross-Site Scripting
≤9.2.07.1Update to 9.2.07.002
CVE-2026-17013
Critical9.1Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion
≤9.2.07.1Update to 9.2.07.002
CVE-2026-18048
Medium4.3Missing Authorization
≤9.2.09.1Update to 9.2.09.002
CVE-2026-18962
Medium5.3Unauthenticated Export ZIP File Deletion
≤9.2.07.1Update to 9.2.07.002
CVE-2026-17014
Medium4.9Authenticated (Administrator+) SQL Injection via 'table' Parameter
≤9.2.04.002Update to 9.2.04.003
CVE-2026-15344
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute
≤9.1.13.005Update to 9.2.01.001
CVE-2026-10095
High7.2Unauthenticated Stored Cross-Site Scripting
≤9.2.02.004Update to 9.2.03.001
CVE-2026-57675
High7.5Unauthenticated SQL Injection
≤9.1.13.005Update to 9.2.01.001
CVE-2026-54829
High7.5Unauthenticated SQL Injection
<9.1.11.001Update to 9.1.11.001
CVE-2026-6379
High7.5Unauthenticated SQL Injection
≤9.1.08.001Update to 9.1.08.002
CVE-2026-39511
High7.1Reflected Cross-Site Scripting
≤9.1.05.008Update to 9.1.05.009
CVE-2025-14835
Medium5.4Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload
≤9.0.11.006Update to 9.0.11.007
CVE-2025-8726
High7.3Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay
≤8.8.08.007Update to 8.9.01.001
CVE-2024-10958
Medium6.1Reflected Cross-Site Scripting
≤8.8.05.003Update to 8.8.07.004
CVE-2024-9951
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤8.8.02.002Update to 8.8.02.003
CVE-2024-38713
Medium6.1Reflected Cross-Site Scripting
≤8.8.00.002Update to 8.8.00.003
CVE-2024-37416
Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤8.7.00.003Update to 8.7.00.004
CVE-2024-4037
Critical10.0Unauthenticated Arbitrary File Upload
≤8.7.01.001Update to 8.7.01.002
CVE-2024-31377
Critical9.9Authenticated (Subscriber+) Arbitrary File Upload
≤8.6.03.004Update to 8.6.03.005
CVE-2024-31286
Medium5.3IP Spoofing
≤8.5.02.005Update to 8.6.01.005
CVE-2023-49774
Medium6.1 Cross-Site Scripting
≤8.5.02.005Update to 8.6.01.005
CVE-2023-49813
Medium5.3Insecure Direct Object Reference
≤8.5.02.005Update to 8.6.01.005
CVE-2023-49812
High7.2Stored Cross-Site Scripting
<8.0.10Update to 8.1.00
CVE-2021-25115
High7.1Cross-Site Scripting
<6.1.3Update to 6.1.3
CVE-2015-3647
Medium6.1Reflected Cross-Site Scripting
≤5.4.17Update to 5.4.18
CVE-2014-8814
Medium6.4Stored Cross-Site Scripting
≤5.4.7Update to 5.4.8
—
Medium6.1Cross-Site Scripting
<5.0.3Update to 5.0.3
CVE-2013-3254
Critical9.8SQL Injection
≤1.0Update to 1.1
CVE-2008-0939

WP Photo Album Plus: common questions

Does WP Photo Album Plus have known vulnerabilities?

Yes. VulnCrest Radar lists 39 known vulnerabilities in WP Photo Album Plus: 4 critical, 14 high, 21 medium. None are known to affect version null.

How do I check which version of WP Photo Album Plus I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WP Photo Album Plus vulnerability?

CVE-2026-119477, published Nov 2, 2026: WP Photo Album Plus <= 9.3.05.003 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).

Is any WP Photo Album Plus vulnerability listed in CISA KEV?

No. None of the known WP Photo Album Plus vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?