CVE-2026-110981 WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyon...