Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

WP Photo Album Plus — Vulnerabilities & Security Advisories 29

All 29 CVE vulnerabilities found in WP Photo Album Plus, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerabilities associated with WP Photo Album Plus, a WordPress plugin developed by T-Soft, focusing primarily on injection flaws and access control weaknesses. The collection covers publicly disclosed security issues documented over the plugin's active support lifecycle. Readers can use this hub to track the vendor’s advisory history, analyze the prevalence of specific weakness classes, and review the chronological progression of vulnerabilities affecting the product.

Vendor: Unknown

CVE ID Title CVSS Severity Published
CVE-2026-102386 WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2026-09-30
CVE-2026-93774 WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-09-23
CVE-2026-87909 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection CWE-74 7.5 High 2026-09-19
CVE-2026-18579 WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting CWE-79 7.2 High 2026-09-11
CVE-2026-18962 WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization - - 2026-08-12
CVE-2026-18049 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo - - 2026-08-12
CVE-2026-18048 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal - - 2026-08-12
CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart - - 2026-08-12
CVE-2026-17014 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips - - 2026-08-09
CVE-2026-14922 WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment - - 2026-07-31
CVE-2026-15344 WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter CWE-89 4.9 Medium 2026-07-29
CVE-2026-57675 WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-07-02
CVE-2026-10095 WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute CWE-79 6.4 Medium 2026-07-01
CVE-2026-54829 WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability CWE-89 7.5 High 2026-06-25
CVE-2026-39511 WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability CWE-89 9.3 Critical 2026-06-15
CVE-2026-6379 WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter - - 2026-05-18
CVE-2025-14835 WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting CWE-80 7.1 High 2026-01-07
CVE-2025-8726 WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload CWE-79 5.4 Medium 2025-10-04
CVE-2024-10958 WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay CWE-94 7.3 High 2024-11-10
CVE-2024-9951 Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting CWE-79 6.1 Medium 2024-10-17
CVE-2024-37416 WordPress WP Photo Album Plus plugin <= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2024-07-22
CVE-2024-38713 WordPress WP Photo Album Plus plugin <= 8.8.02.002 - Authenticated Stored Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2024-07-20
CVE-2023-49774 WordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerability CWE-200 5.3 Medium 2024-06-04
CVE-2024-4037 WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution CWE-94 6.5 Medium 2024-05-24
CVE-2024-31377 WordPress WP Photo Album Plus plugin <= 8.7.01.001 - Unauth. Arbitrary File Upload vulnerability CWE-434 10.0 Critical 2024-05-13
CVE-2024-31286 WordPress WP Photo Album Plus plugin < 8.6.03.005 - Arbitrary File Upload vulnerability CWE-434 9.9 Critical 2024-04-07
CVE-2023-49812 WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR) CWE-639 5.3 Medium 2023-12-19
CVE-2023-49813 WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS) CWE-79 7.1 High 2023-12-14
CVE-2021-25115 WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS) CWE-79 5.4 - 2022-02-14

All 29 known CVE vulnerabilities affecting WP Photo Album Plus with full Chinese analysis, references, and POCs where available.