cve-2026-6379

CVE-2026-6379 — WP Photo Album Plus :8080/?pageid=" --mode probe python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode probe-calendar python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode version python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode hash A vulnerable target replies in...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Ejecución Arbitraria de Shortcodes CVE-2024-10958 Código PoC para la vulnerabilidad de ejecución arbitraria de shortcodes sin autenticación en el plugin WordPress WP Photo Album Plus. Detalles Versiones Afectadas: = 8.8.08.007 Puntuación CVSS: 7.3 Alta Tipo de...

EUVD-2026-85468

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

CVE-2026-93774

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the WP Photo Album Plus WordPress plugin, affecting versions

CVE-2026-93774: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

CVE-2026-87909

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

CVE-2026-87909 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

CVE-2026-87909

The WP Photo Album Plus WordPress plugin (versions ≤ 9.2.09.002 ) is vulnerable to authenticated remote code execution (CVSS 7.5 HIGH) via the wppa_image_magick function. The root cause is insufficient sanitization of a multipart upload filename before it is concatenated into an ImageMagick comma...

CVE-2026-87909 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

EUVD-2026-83471

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

CVE-2026-87909: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppaimagemagick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec, with only...

WordPress WP Photo Album Plus plugin <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability

Authenticated Subscriber+ Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.2.09.002...

WordPress WP Photo Album Plus plugin <= 9.2.08.003 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin WP Photo Album Plus versions = 9.2.08.003...

CVE-2026-18579

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

EUVD-2026-75953

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-18579 WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-18579

WP Photo Album Plus (WordPress plugin) versions up to and including 9.2.08.003 are vulnerable to unauthenticated Stored XSS via the HTTP_X_FORWARDED_FOR parameter. The root cause is insufficient input sanitization and output escaping: a deliberately failed nonce check on the getshortcodedrendered...

CVE-2026-18579: Improper Neutralization of Input During Web Page Generation

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPXFORWARDEDFOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

PT-2026-89751

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP X FORWARDED FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WordPress WP Photo Album Plus plugin < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips vulnerability

Unauthenticated Export ZIP File Deletion via delexportzips vulnerability discovered by Vaibhav Narkhede in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...