Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: WP Photo Album Plus 9.2.07.002 Clear all filters
TI-2026-14862 CVE-2026-18049 · GHSA-8pjc-hhvr-vf36

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

Priority HIGH 72

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting i…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00434 Published 2026-08-12 Fixed in 9.2.07.002 CWE-200
TI-2026-14861 CVE-2026-18048 · GHSA-7qh7-857w-wvvg

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal

Priority HIGH 72

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00382 Published 2026-08-12 Fixed in 9.2.07.002 CWE-73
TI-2026-14165 CVE-2026-17013 · GHSA-7x94-87h5-h3g2

WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

Priority MEDIUM 60

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00258 Published 2026-08-12 Fixed in 9.2.07.002 CWE-287