CVE-2026-14922

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.03.001

Description A stored Cross-Site Scripting issue exists due to a decode-after-sanitize flaw in the photo-comment pipeline. The wppa do comment() function sanitizes comments using wppa filter html() and wp strip all tags(). However, because wp strip all tags() only removes actual tags, an attacker can bypass these filters by submitting a double HTML-entity-encoded payload. This allows the payload to be stored in the database and subsequently executed in the browser of users viewing the comment.

Recommendations Update to a version newer than 9.2.03.001.