CVE-2024-9951

🗓️ 17 Oct 2024 07:34:44Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 42 Views

The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including, 8.8.05.003 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts in pages through user actions

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-9951	17 Oct 202410:47	–	circl
CNNVD	WordPress plugin WP Photo Album Plus 跨站脚本漏洞	17 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-9951 Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting	17 Oct 202407:34	–	cvelist
EUVD	EUVD-2024-50233	3 Oct 202520:07	–	euvd
NVD	CVE-2024-9951	17 Oct 202408:15	–	nvd
Patchstack	WordPress WP Photo Album Plus Plugin <= 8.8.05.003 is vulnerable to Cross Site Scripting (XSS)	16 Oct 202400:00	–	patchstack
Patchstack	WordPress Wordpress Photo Album Plus plugin <= 8.8.05.003 - Reflected Cross-Site Scripting vulnerability	16 Oct 202420:55	–	patchstack
Positive Technologies	PT-2024-39962 · WordPress · Wp Photo Album Plus	17 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9951	23 May 202508:13	–	redhatcve
Vulnrichment	CVE-2024-9951 Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting	17 Oct 202407:34	–	vulnrichment

Vulners

Vulnrichment

Node

opajaap wp_photo_album_plusRange≤8.8.05.003wordpress

[
  {
    "vendor": "opajaap",
    "product": "WP Photo Album Plus",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "8.8.05.003",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/3a4f0c06-db88-4950-b1f5-b2aab480c974

15 Apr 2026 00:35Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.16.1

EPSS0.01302

SSVC

CWE-79