CVE-2026-17013

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.07.002

Description An issue exists where a parameter is not properly sanitized and escaped before being reflected into an inline script block. This allows unauthenticated attackers to execute Reflected Cross-Site Scripting (XSS) attacks—a technique where malicious scripts are injected into trusted websites—against users who are tricked into clicking a specially crafted link to a page displaying a gallery. The vulnerable parameter is lbstart.

Recommendations Update WP Photo Album Plus to version 9.2.07.002 or later. Avoid using the lbstart parameter in gallery links until the update is applied.