CVE-2026-18579

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.2.08.004

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the HTTP X FORWARDED FOR parameter. An attacker can trigger the wppa log() function by deliberately failing a nonce check for the getshortcodedrenderedfenodelay action, which causes the attacker-supplied value to be recorded to disk. This process is reachable through the wp ajax nopriv wppa endpoint, enabling the execution of arbitrary web scripts when a user accesses an affected page.

Recommendations Update WP Photo Album Plus to version 9.2.08.004 or later.