CVE-2026-110981
WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
| Vendor | unknown |
| Product | wp photo album plus |
| Published | Oct 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp photo album plus
Be the first to know when new unknown vulnerabilities affecting unknown wp photo album plus are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Photo Album Plus
0 < 9.2.11.002
References
Credits
Karthik Ramakrishnan WPScan