CVE-2026-96278

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.3.03.003

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via the REQUEST URI Session History. This occurs because the esc url raw() function removes literal angle brackets but keeps HTML entities, which are then converted back into active HTML tags by the wppaEntityDecode() function before being rendered by the jQuery('#wppa-modal-container').html() method. This enables the injection of arbitrary web scripts that execute when a user visits an affected page.

Recommendations Update WP Photo Album Plus to a version newer than 9.3.03.002.