CVE-2026-110981

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyon...

CVE-2026-110981

The WP Photo Album Plus WordPress plugin, in versions prior to 9.2.11.002 , contains a Reflected Cross-Site Scripting (XSS) vulnerability. The issue arises because the plugin fails to properly escape a category navigation value (specifically the 'wppa-cat' parameter) before reflecting it into a J...

CVE-2026-110981 WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyon...

CVE-2026-110981 WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyon...

EUVD-2026-103399

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyon...