CVE-2026-18579: WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce failure path for the getshortcodedrenderedfenodelay action serves as the log-write trigger rather than an access barrier — a deliberately failed nonce check causes wppalog() to record the attacker-supplied X-Forwarded-For value to disk, making the exploit fully reachable by unauthenticated callers via the wpajaxnoprivwppa endpoint.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. The exposed path is reachable through the wp_ajax_nopriv_wppa endpoint, so no WordPress account or valid nonce is required.
What request condition triggers the vulnerable log write?
The attacker supplies a malicious value in the X-Forwarded-For HTTP header and invokes the getshortcodedrenderedfenodelay action. A deliberately failed nonce check triggers wppa_log() to write that supplied value to disk rather than blocking the request.
Which installations are affected?
WP Photo Album Plus versions through 9.2.08.003 are affected. The issue is reachable through an unauthenticated endpoint, so installations exposing the plugin's normal WordPress AJAX handling are within scope.
What is the impact after successful exploitation?
The injected script is stored and executes when a user accesses an injected page. This can expose or modify content available in that user's browser session; the provided severity vector indicates scope change with low confidentiality and integrity impact.