CVE-2026-110981: WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter

Q: What user interaction is required for exploitation?

An attacker must persuade someone to follow a crafted gallery link and then click a gallery breadcrumb. The injected script executes in that person’s browser only after the breadcrumb click.

Q: Can an unauthenticated attacker exploit this issue?

Yes. The issue can be triggered through a crafted gallery link without the attacker needing to authenticate.

Q: Who is at risk if a malicious link is used?

Anyone who follows the crafted link and clicks the affected breadcrumb can be impacted. This includes logged-in WordPress administrators, whose browser session may make the impact more significant.

Q: Which plugin versions are affected?

WP Photo Album Plus versions before 9.2.11.002 are affected.

Published Oct 18, 2026

Updated

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.

Affected Software

1 affected component

WP Photo Album Plus<9.2.11.002

Event History

Oct 18, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

What user interaction is required for exploitation?

An attacker must persuade someone to follow a crafted gallery link and then click a gallery breadcrumb. The injected script executes in that person’s browser only after the breadcrumb click.

Can an unauthenticated attacker exploit this issue?

Yes. The issue can be triggered through a crafted gallery link without the attacker needing to authenticate.

Who is at risk if a malicious link is used?

Anyone who follows the crafted link and clicks the affected breadcrumb can be impacted. This includes logged-in WordPress administrators, whose browser session may make the impact more significant.

Which plugin versions are affected?

WP Photo Album Plus versions before 9.2.11.002 are affected.

CVE-2026-110981: WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter

Affected Software

Event History

Frequently Asked Questions

What user interaction is required for exploitation?

Can an unauthenticated attacker exploit this issue?

Who is at risk if a malicious link is used?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What user interaction is required for exploitation?

Can an unauthenticated attacker exploit this issue?

Who is at risk if a malicious link is used?

Which plugin versions are affected?