CVE-2026-96278: WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History

Q: Which installations are affected?

WP Photo Album Plus versions up to and including 9.3.03.002 are affected.

Q: Does exploitation require an account or user interaction?

No. The vulnerability can be exploited by an unauthenticated attacker without user interaction to inject the payload; the injected script executes when a user later accesses the affected page.

Q: What is the impact of a successful exploit?

An attacker can store arbitrary web script in an injected page. The script runs in the browser of users who access that page, with low confidentiality and integrity impact indicated by the supplied vector.

Q: What input-handling behavior enables the bypass?

Literal angle brackets are removed by esc_url_raw(), but HTML entities remain. wppaEntityDecode() converts those entities back into HTML tags before the value is rendered through jQuery('#wppa-modal-container').html().

Published Oct 10, 2026

Updated

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because escurlraw() strips literal angle brackets but retains HTML entities, which wppaEntityDecode() silently converts back to live HTML tags before jQuery('#wppa-modal-container').html() renders them.

Affected Software

1 affected component

WP Photo Album Plus WP Photo Album Plus<=9.3.03.002

Event History

Oct 10, 2026

CVE Published

via MITRE·07:41 AM

Data Sourced

via MITRE·07:41 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

WP Photo Album Plus versions up to and including 9.3.03.002 are affected.

Does exploitation require an account or user interaction?

No. The vulnerability can be exploited by an unauthenticated attacker without user interaction to inject the payload; the injected script executes when a user later accesses the affected page.

What is the impact of a successful exploit?

An attacker can store arbitrary web script in an injected page. The script runs in the browser of users who access that page, with low confidentiality and integrity impact indicated by the supplied vector.

What input-handling behavior enables the bypass?

Literal angle brackets are removed by esc_url_raw(), but HTML entities remain. wppaEntityDecode() converts those entities back into HTML tags before the value is rendered through jQuery('#wppa-modal-container').html().

CVE-2026-96278: WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require an account or user interaction?

What is the impact of a successful exploit?

What input-handling behavior enables the bypass?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require an account or user interaction?

What is the impact of a successful exploit?

What input-handling behavior enables the bypass?