WP Photo Album Plus

wp-photo-album-plus · plugin

Known security vulnerabilities for WP Photo Album Plus. Find out in seconds which version runs on your site with WP Lens.

24 known vulnerabilities

3 critical · 15 exploitable without logging in · 1 with public exploit code · latest Sep 30, 2026

Listed on wordpress.org · latest 9.3.03.003 · last updated Sep 29, 2026 · 10K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

CVE-2024-31377unauthenticated≤ 8.7.01.001
WordPress WP Photo Album Plus plugin <= 8.7.01.001 - Unauth. Arbitrary File Upload vulnerability
Critical 10.0
CVE-2024-31286login required→ 8.6.03.005
WordPress WP Photo Album Plus plugin < 8.6.03.005 - Arbitrary File Upload vulnerability
Critical 9.9
CVE-2026-39511unauthenticated≤ 9.1.08.001
WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability
Critical 9.3
CVE-2026-54829unauthenticated≤ 9.1.13.005
WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability
High 7.5
CVE-2023-49812unauthenticated≤ 8.5.02.005
WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR)
High 7.5
CVE-2026-87909subscriber+≤ 9.2.09.002
WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
High 7.5
CVE-2024-10958unauthenticated≤ 8.8.08.007
WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay
High 7.3
CVE-2024-4037unauthenticated≤ 8.7.00.003
WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution
High 7.3
CVE-2026-18579unauthenticated≤ 9.2.08.003
WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting
High 7.2
CVE-2026-93774unauthenticated · needs a click≤ 9.3.02.002
WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability
High 7.1
CVE-2026-57675unauthenticated · needs a click≤ 9.2.02.004
WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability
High 7.1
CVE-2025-14835unauthenticated · needs a click≤ 9.1.05.008
WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting
High 7.1
CVE-2026-102386subscriber+≤ 9.3.02.003
WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2024-38713login required≤ 8.8.02.002
WordPress WP Photo Album Plus plugin <= 8.8.02.002 - Authenticated Stored Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2021-25115unauthenticated→ 8.0.10
WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)
Medium 6.4
CVE-2026-10095contributor+≤ 9.1.13.005
WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute
Medium 6.4
CVE-2024-9951unauthenticated · needs a click≤ 8.8.05.003
Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting
Medium 6.1
CVE-2024-37416unauthenticated · needs a click≤ 8.8.00.002
WordPress WP Photo Album Plus plugin <= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerability
Medium 6.1
CVE-2023-49813unauthenticated · needs a click≤ 8.5.02.005
WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS)
Medium 6.1
CVE-2025-8726subscriber+≤ 9.0.11.006
WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload
Medium 5.4
CVE-2023-49774unauthenticated≤ 8.5.02.005
WordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerability
Medium 5.3
CVE-2026-15344admin≤ 9.2.04.002
WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
Medium 4.9
CVE-2015-3647
Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for Wor
Medium 4.3
CVE-2013-3254
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote at
Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory