CVE-2026-14922: WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, wppadocomment() sanitizes the comment with wppafilterhtml() (wpkses) followed by wpstripalltags() (wppa-functions.php:2623-2624). Because wpstripalltags() only removes real tags, an attacker who submits a double HTML-entity-encoded payload (e.g. &lt;img src=... onload=...&gt;) passes the write filters as harmless entity text and is stored one decode-level down (<img ... onload=...>).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Photo Album Plusto a version that resolves this vulnerability.Fixed in 9.2.04.003 - Compensating control
Mitigate stored XSS by restricting/commenting access so only trusted users can submit photo comments, preventing untrusted payloads from being stored and later decoded/rendered.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14922?
CVE-2026-14922 has a risk score of 43, indicating a moderate severity level.
How do I fix CVE-2026-14922?
To fix CVE-2026-14922, update WP Photo Album Plus to version 9.2.04.003 or later.
What type of vulnerability is CVE-2026-14922?
CVE-2026-14922 is a stored Cross-Site Scripting (XSS) vulnerability.
What versions are affected by CVE-2026-14922?
CVE-2026-14922 affects all versions of WP Photo Album Plus up to and including 9.2.03.001.
How can CVE-2026-14922 be exploited?
CVE-2026-14922 can be exploited through a double-encoding flaw in the photo-comment pipeline, allowing attackers to inject malicious scripts.