CVE-2026-10095: WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1.13.005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can embed the malicious [photo] shortcode in a post submitted for review, causing the stored payload to execute when an administrator or any other user views the post.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Photo Album Plusto a version that resolves this vulnerability.Fixed in 9.1.13.005 - Configuration
Fix the stored XSS by ensuring the 'subtext' parameter used by the [photo] shortcode is properly input-sanitized and output-escaped in WP Photo Album Plus.
WordPress (WP Photo Album Plus) subtext parameter (shortcode attribute) = sanitized/escaped - Compensating control
Restrict contributor-level accounts from submitting posts that include the [photo] shortcode (or restrict/limit shortcode embedding in submitted content) to reduce the chance an attacker can store a malicious payload.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10095?
CVE-2026-10095 has a severity rating of medium at 6.4.
How do I fix CVE-2026-10095?
To fix CVE-2026-10095, upgrade the WP Photo Album Plus plugin to version 9.1.13.006 or later.
Who can exploit CVE-2026-10095?
CVE-2026-10095 can be exploited by authenticated attackers with contributor-level access.
What type of vulnerability is CVE-2026-10095?
CVE-2026-10095 is a Stored Cross-Site Scripting (XSS) vulnerability.
What is the affected software version for CVE-2026-10095?
CVE-2026-10095 affects all versions of WP Photo Album Plus up to and including 9.1.13.005.