CVE-2026-110981 — WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its galle…
Published: 2026-10-18 · CVSS: 7.1 · CVSS 3.1
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7