CVE-2026-6379 — WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to pe…
Published: 2026-05-18 · CVSS: 8.6 · CVSS 3.1
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7