CVE-2026-14922

CVE-2026-14922 affects WP Photo Album Plus prior to version 9.2.04.003 (inclusive of 9.2.03.001 and earlier). The root cause is a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline: on write, comments are sanitized with wp_kses and then wp_strip_all_tags, which only remove...