CVE-2026-93774: WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability
Published Sep 23, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
Affected Software
1 affected component
WordPress WP Photo Album Plus<=9.3.02.002
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Photo Album Plus pluginto a version that resolves this vulnerability.Fixed in 9.3.02.003
Event History
Sep 23, 2026
CVE Published
via MITRE·06:14 PM
Data Sourced
via MITRE·06:14 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:19 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the site. Exploitation still requires user interaction, as indicated by the UI:R vector.
2
Which plugin versions are affected?
WP Photo Album Plus versions 9.3.02.002 and earlier are identified as affected.
3
What is the potential impact if exploitation succeeds?
The provided severity vector indicates low impacts to confidentiality, integrity, and availability, with scope changed. As an XSS issue, successful exploitation could execute attacker-controlled script in a victim's browser.