Skip to content
OpenAdvisories

Vendor

opajaap

11 known vulnerabilities.

Products

WP Photo Album Plus 11
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.8
    CVE-2026-92115

    WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action

    The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `…

    opajaap WP Photo Album Plus Web / CMS
  • High 7.2
    CVE-2026-96278

    WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History

    The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for u…

    opajaap WP Photo Album Plus Web / CMS
  • High 7.5
    CVE-2026-87909

    WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

    The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command …

    opajaap WP Photo Album Plus Web / CMS
  • High 7.2
    CVE-2026-18579

    WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting

    The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possi…

    opajaap WP Photo Album Plus Web / CMS
  • High 7.1
    CVE-2025-14835

    WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting

    The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for …

    opajaap WP Photo Album Plus Web / CMS
  • High 7.3
    CVE-2024-10958 Public exploit

    WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay

    The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to execute an action t…

    opajaap WP Photo Album Plus Web / CMS