CVE-2026-119477: WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability

Q: Who is exposed to this issue?

Sites using WP Photo Album Plus version 9.3.05.003 or earlier are affected. The vulnerability can be reached over the network and does not require the attacker to have an authenticated account, but it does require user interaction.

Q: What is the potential impact of successful exploitation?

Successful exploitation allows stored cross-site scripting. The supplied severity vector indicates low-impact compromise of confidentiality, integrity, and availability, with impacts extending beyond the vulnerable component.

Published Nov 4, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/wp-photo-album-plus to a version that resolves this vulnerability.
Fixed in 9.3.06.001

Event History

Nov 4, 2026

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using WP Photo Album Plus version 9.3.05.003 or earlier are affected. The vulnerability can be reached over the network and does not require the attacker to have an authenticated account, but it does require user interaction.

What is the potential impact of successful exploitation?