CVE-2026-102386: WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability
Published Sep 30, 2026
·Updated
Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.
Affected Software
1 affected component
WordPress WP Photo Album Plus<=9.3.02.003
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Photo Album Plusto a version that resolves this vulnerability.Fixed in 9.3.03.002
Event History
Sep 30, 2026
CVE Published
via MITRE·12:28 PM
Data Sourced
via MITRE·12:28 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The issue is exploitable by a user with Subscriber-level access. It also requires user interaction, as indicated by the UI:R vector.
2
What impact could successful exploitation have?
Successful exploitation can affect confidentiality, integrity, and availability at a low level. The impact scope can extend beyond the vulnerable component, as indicated by S:C.
3
Which plugin versions are affected?
WP Photo Album Plus versions up to and including 9.3.02.003 are affected.