WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.
Why it matters now
EPSS 0.00683 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP Photo Album Plus (Unknown): 8.0.10
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | WP Photo Album Plus | 8.0.10 to before 8.0.10 | 8.0.10 | Patch available | CNA |
- WP Photo Album Plus VendorUnknown Affected 8.0.10 to before 8.0.10 Fixed in 8.0.10 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wppa:wp_photo_album_plus:*:*:*:*:*:wordpress:*:* | before 8.0.10.006 | Vulnerable | J.N. Breetvelt a.k.a. OpaJaap |
- cpe:2.3:a:wppa:wp_photo_album_plus:*:*:*:*:*:wordpress:*:* Versions before 8.0.10.006 Vulnerable ·J.N. Breetvelt a.k.a. OpaJaap
Remediation
- Fix · CNA WP Photo Album Plus (Unknown) Fixed in 8.0.10
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25115
- 2026-10-03 Alias added: GHSA-9f55-856w-xqjx
References
More J.N. Breetvelt a.k.a. OpaJaap Wp Photo Album Plus vulnerabilities
- TI-2024-10157 WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay CVSS 3.1HIGH 7.3
- TI-2023-27216 WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR) CVSS 3.1HIGH 7.5
- TI-2024-03766 WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution CVSS 3.1HIGH 7.3
- TI-2024-24920 WordPress WP Photo Album Plus plugin <= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2023-27217 WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
Sources
- CVE-2021-25115 · CVE Program
- CVE-2021-25115 · NVD
- FIRST EPSS
- GHSA-9f55-856w-xqjx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences