CVE-2026-110983— WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
Quick assessment
Affected
Unknown WP Photo Album Plus
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 WP Photo Album Plus 在版本 9.3.04.004 之前，未对其评论管理请求中的请求来源或安全令牌进行验证，攻击者可借此诱导拥有评论审核权限的已登录用户加载恶意构造的页面，从而删除照片评论。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110983
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Photo Album Plus | 0 ~ 9.3.04.004 | - |
|
II. Public POCs for CVE-2026-110983
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110983
请登录查看更多情报信息。
Other References for CVE-2026-110983 (1)
-
https://wpscan.com/vulnerability/3375c88c-7f61-47d6-b9e0-76ad86ce1800/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-29 · 28 CVEs total
| CVE-2026-115303 | 3.7 LOW | Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Rep |
| CVE-2026-103693 | Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injectio | |
| CVE-2026-115282 | Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosur | |
| CVE-2026-115302 | Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion | |
| CVE-2026-115301 | Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block | |
| CVE-2026-115299 | Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF | |
| CVE-2026-115300 | Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF | |
| CVE-2026-88928 | PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via | |
| CVE-2026-78395 | Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass | |
| CVE-2026-78396 | Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure | |
| CVE-2026-89216 | vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter | |
| CVE-2026-108763 | Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR | |
| CVE-2026-108686 | WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure | |
| CVE-2026-108685 | WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile | |
| CVE-2026-105258 | LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings | |
| CVE-2024-3586 | LetterPress < 2.4.0 - Admin+ Stored XSS | |
| CVE-2026-110504 | Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization B | |
| CVE-2026-110030 | Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration | |
| CVE-2026-110505 | Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass | |
| CVE-2026-113616 | LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: WP Photo Album Plus
-
CVE-2026-110981
WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-c -
CVE-2026-92115
WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) -
CVE-2026-96278
WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored C -
CVE-2026-102386
WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross S -
CVE-2026-93774
WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross S
Same vendor: Unknown
-
CVE-2026-115303
Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / -
CVE-2026-86794
Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS -
CVE-2026-85007
YT Player < 2.1.4 - Contributor+ Missing Authorization via y -
CVE-2026-114270
GeoDirectory < 2.8.197 - Unauthenticated Password-Protected -
CVE-2026-113617
Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbi