WP Photo Album Plus

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   WP Photo Album Plus

Information

Software Type Plugin
Software Slug wp-photo-album-plus (view on wordpress.org)
Software Status Active
Software Author opajaap
Software Website wppa.nl
Software Downloads 3,490,037
Software Active Installs 10,000
Software Record Last Updated October 6, 2026

Showing 1-20 of 33 Vulnerabilities

Submit a Vulnerability
WP Photo Album Plus <= 9.3.02.002 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-93774
Sep 23, 2026
Researcher: daroo
WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
7.5
CVE-2026-87909
Sep 18, 2026
Researcher: daroo
WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-18579
Sep 10, 2026
Researcher: Jonah Burgess (CryptoCat)
WP Photo Album Plus < 9.2.07.002 - Missing Authorization
5.3
CVE-2026-18049
Aug 14, 2026
Researcher: Erwan LR
WP Photo Album Plus < 9.2.04.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-14922
Aug 13, 2026
Researcher: Sai Praneeth Koti
Photo Album Plus <= 9.2.07.1 - Reflected Cross-Site Scripting
6.1
CVE-2026-17013
Aug 10, 2026
Researcher: Muni Nitish Kumar Yaddala
Photo Album Plus <= 9.2.09.1 - Missing Authorization
4.3
CVE-2026-18962
Aug 10, 2026
Researcher: Farid Narimanov
Photo Album Plus <= 9.2.07.1 - Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion
9.1
CVE-2026-18048
Aug 10, 2026
Researcher: Erwan LR
Photo Album Plus <= 9.2.07.1 - Unauthenticated Export ZIP File Deletion
5.3
CVE-2026-17014
Aug 3, 2026
Researcher: Vaibhav Narkhede
WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
4.9
CVE-2026-15344
Jul 28, 2026
Researcher: Wordfence PRISM
WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute
6.4
CVE-2026-10095
Jun 30, 2026
Researcher: Muhammad Yudha - DJ
WP Photo Album Plus <= 9.2.02.004 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-57675
Jun 30, 2026
Researcher: Nguyen Ba Khanh
WP Photo Album Plus <= 9.1.13.005 - Unauthenticated SQL Injection
7.5
CVE-2026-54829
Jun 17, 2026
Researcher: daroo
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection
7.5
CVE-2026-6379
Jun 11, 2026
Researcher: Daniel Púa - devploit
WP Photo Album Plus <= 9.1.08.001 - Unauthenticated SQL Injection
7.5
CVE-2026-39511
Apr 13, 2026
Researcher: Martín Martín
WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting
7.1
CVE-2025-14835
Jan 6, 2026
Researcher: Muhammad Yudha - DJ
WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload
5.4
CVE-2025-8726
Oct 3, 2025
Researcher: zer0gh0st
WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay
7.3
CVE-2024-10958
Nov 10, 2024
Researcher: Arkadiusz Hydzik
Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting
6.1
CVE-2024-9951
Oct 16, 2024
Researcher: Noah Stead (TurtleBurg)
WP Photo Album Plus <= 8.8.02.002 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2024-38713
Jul 11, 2024
Researcher: stealthcopter
Title Status CVE ID CVSS Researchers Date
WP Photo Album Plus <= 9.3.02.002 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-93774 7.2 daroo September 23, 2026
WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection Patched CVE-2026-87909 7.5 daroo September 18, 2026
WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-18579 7.2 Jonah Burgess (CryptoCat) September 10, 2026
WP Photo Album Plus < 9.2.07.002 - Missing Authorization Patched CVE-2026-18049 5.3 Erwan LR August 14, 2026
WP Photo Album Plus < 9.2.04.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2026-14922 6.4 Sai Praneeth Koti August 13, 2026
Photo Album Plus <= 9.2.07.1 - Reflected Cross-Site Scripting Patched CVE-2026-17013 6.1 Muni Nitish Kumar Yaddala August 10, 2026
Photo Album Plus <= 9.2.09.1 - Missing Authorization Patched CVE-2026-18962 4.3 Farid Narimanov August 10, 2026
Photo Album Plus <= 9.2.07.1 - Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion Patched CVE-2026-18048 9.1 Erwan LR August 10, 2026
Photo Album Plus <= 9.2.07.1 - Unauthenticated Export ZIP File Deletion Patched CVE-2026-17014 5.3 Vaibhav Narkhede August 3, 2026
WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter Patched CVE-2026-15344 4.9 Wordfence PRISM July 28, 2026
WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute Patched CVE-2026-10095 6.4 Muhammad Yudha - DJ June 30, 2026
WP Photo Album Plus <= 9.2.02.004 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-57675 7.2 Nguyen Ba Khanh June 30, 2026
WP Photo Album Plus <= 9.1.13.005 - Unauthenticated SQL Injection Patched CVE-2026-54829 7.5 daroo June 17, 2026
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection Patched CVE-2026-6379 7.5 Daniel Púa - devploit June 11, 2026
WP Photo Album Plus <= 9.1.08.001 - Unauthenticated SQL Injection Patched CVE-2026-39511 7.5 Martín Martín April 13, 2026
WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting Patched CVE-2025-14835 7.1 Muhammad Yudha - DJ January 6, 2026
WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload Patched CVE-2025-8726 5.4 zer0gh0st October 3, 2025
WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay Patched CVE-2024-10958 7.3 Arkadiusz Hydzik November 10, 2024
Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting Patched CVE-2024-9951 6.1 Noah Stead (TurtleBurg) October 16, 2024
WP Photo Album Plus <= 8.8.02.002 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2024-38713 6.4 stealthcopter July 11, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation