CVE-2025-14835: WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14835?
CVE-2025-14835 is classified as a high severity vulnerability due to the potential for unauthenticated attackers to exploit it.
How do I fix CVE-2025-14835?
To fix CVE-2025-14835, you should update the WP Photo Album Plus plugin to version 9.1.05.009 or later.
What kind of vulnerability is CVE-2025-14835?
CVE-2025-14835 is a Reflected Cross-Site Scripting vulnerability caused by insufficient input sanitization in the shortcode parameter.
Which versions of WP Photo Album Plus are affected by CVE-2025-14835?
CVE-2025-14835 affects all versions of WP Photo Album Plus up to and including 9.1.05.008.
Can authenticated users exploit CVE-2025-14835?
No, CVE-2025-14835 can be exploited by unauthenticated attackers, making it particularly concerning for public-facing WordPress sites.