Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Vendor: opajaap Clear all filters
TI-2026-75232 CVE-2026-92115 · GHSA-2fg2-xfvj-r3qp

Command injection in WP Photo Album Plus lets attackers run commands

Priority MEDIUM 43

The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01433 Published 2026-10-16 No fix listed CWE-77
TI-2026-70201 CVE-2026-96278 · GHSA-36x3-mvq9-4q26

Stored cross-site scripting in WP Photo Album Plus WordPress plugin

Priority LOW 31

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00254 Published 2026-10-10 No fix listed CWE-79
TI-2026-59976 CVE-2026-87909 · GHSA-mx4x-6r5x-jrh9

Injection in opajaap WP Photo Album Plus

Priority LOW 37

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0091 Published 2026-09-19 No fix listed CWE-74
TI-2026-15226 CVE-2026-18579 · GHSA-5mj5-4x3x-pjmq

WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 38

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization a…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00508 Published 2026-09-11 No fix listed CWE-79
TI-2026-12914 CVE-2026-15344 · GHSA-5w4j-6h6c-4hr2

WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter

Priority LOW 23

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter a…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00597 Published 2026-07-29 No fix listed CWE-89
TI-2026-08849 CVE-2026-10095 · GHSA-f7vj-52f2-pr4x

Cross-site scripting in opajaap WP Photo Album Plus

Priority LOW 29

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output esc…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00419 Published 2026-07-01 No fix listed CWE-79
TI-2025-13532 CVE-2025-14835 · GHSA-f7fp-6q7q-4mc8

WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting

Priority LOW 31

The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and outpu…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0028 Published 2026-01-07 No fix listed CWE-80
TI-2025-07983 CVE-2025-8726 · GHSA-7frm-hgr3-3vhq

WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload

Priority LOW 24

The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppa_user_upload funct…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00215 Published 2025-10-04 No fix listed CWE-79
TI-2024-09234 CVE-2024-9951 · GHSA-79v7-wxc5-r58h

Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting

Priority LOW 29

The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including, 8.8.05.003 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00317 Published 2024-10-17 No fix listed CWE-79