CVE-2026-110981: WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
Affected Software
Event History
Frequently Asked Questions
What user interaction is required for exploitation?
An attacker must persuade someone to follow a crafted gallery link and then click a gallery breadcrumb. The injected script executes in that person’s browser only after the breadcrumb click.
Can an unauthenticated attacker exploit this issue?
Yes. The issue can be triggered through a crafted gallery link without the attacker needing to authenticate.
Who is at risk if a malicious link is used?
Anyone who follows the crafted link and clicks the affected breadcrumb can be impacted. This includes logged-in WordPress administrators, whose browser session may make the impact more significant.
Which plugin versions are affected?
WP Photo Album Plus versions before 9.2.11.002 are affected.