CVE-2026-10095: WP Photo Album Plus Stored XSS Vulnerability (v9.1.13.005 and Earlier)

Technical summary

The vulnerability stems from insufficient input sanitization and output escaping in the WP Photo Album Plus plugin's handling of the 'subtext' parameter. The plugin fails to properly sanitize user input before storage and does not adequately escape output when rendering the [photo] shortcode. This allows authenticated users with contributor-level permissions or above to craft a malicious post containing a [photo] shortcode with JavaScript embedded in the subtext field. The payload is stored in the WordPress database and executed server-side when any user accesses the post, including administrators viewing draft content. The attack vector is network-based with low attack complexity, requiring only valid WordPress authentication.

Business impact

Organizations running WP Photo Album Plus face several operational risks. An attacker with contributor access—a common role for freelance writers, guest bloggers, or editorial staff—can silently compromise any post or page. Stored XSS in admin-facing content is particularly dangerous because administrators often have higher privileges; an attacker can steal admin session cookies to gain complete site control. Content integrity is compromised, as malicious scripts may deface pages, inject advertisements, or redirect users to phishing sites. Multi-site WordPress installations amplify the risk if a single compromised contributor account can inject payloads affecting content seen by thousands of users. Incident response becomes complex due to the stored nature of the payload.

Affected systems

WP Photo Album Plus versions 9.1.13.005 and earlier are affected. The plugin is installed on sites across a wide range of WordPress deployments, from small blogs to enterprise content platforms. Any WordPress site using this plugin where contributor-level users can submit or edit posts is at risk. The vulnerability affects the plugin's core functionality, so all active installations are potentially vulnerable unless already patched. Organizations should audit plugin version numbers across all WordPress instances in their environment.

Exploitability

The vulnerability requires authenticated access and contributor-level permissions or above. While this is not an unauthenticated attack, contributor status is commonly granted to external content creators, making the barrier to exploitation relatively low in many organizations. No special tools or advanced techniques are required—an attacker simply crafts a WordPress post with a malicious [photo] shortcode, submitting it for publication. Administrators reviewing draft content will trigger the payload without any additional user interaction required. The attack does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been confirmed at the time of publication, though this does not guarantee the vulnerability is unexploited.

Remediation

Update WP Photo Album Plus to a version that addresses the vulnerability. Verify the specific patched version against the plugin vendor's security advisory and release notes. As an interim measure, restrict contributor-level permissions to trusted users only, and consider disabling the plugin if it is not actively used. For high-risk sites, temporarily prevent contributors from submitting new posts until patching is complete. Review all existing posts and pages created by contributors in recent months for signs of injected scripts. Use WordPress security plugins to monitor for suspicious code patterns in post content.

Patch guidance

Check the official WP Photo Album Plus plugin repository or vendor advisory for version 9.1.13.006 or later that resolves the input sanitization and output escaping flaws. Patch testing should include verifying that the [photo] shortcode no longer executes JavaScript in the subtext parameter across different WordPress and PHP versions your organization uses. Before deploying to production, test post submission and viewing workflows with both contributor and administrator accounts. Backup your WordPress database and media files before applying updates.

Detection guidance

Search your WordPress post and page content for instances of the [photo] shortcode, particularly those created or modified by contributor-level users after the plugin was installed. Look for unusual HTML or JavaScript characters in the subtext parameter of these shortcodes—encoded entities, script tags, or event handlers are red flags. Monitor WordPress debug logs and security plugins for JavaScript execution warnings or Content Security Policy violations. Check browser console output when viewing posts to identify unexpected network requests or script errors that could indicate injected payloads. Use grep or database queries to find posts containing suspicious patterns like `<script`, `javascript:`, or `onerror=` within the [photo] shortcode parameters.

Why prioritize this

This vulnerability merits prompt attention despite its MEDIUM severity rating. The stored nature of XSS makes it persistent and difficult to remediate retroactively, affecting all users who view compromised content. The low barrier to exploitation—requiring only common contributor-level access—combined with the ability to compromise administrator accounts and gain full site control, elevates practical risk above the CVSS score alone. WordPress sites are high-value targets for malware distribution and SEO manipulation, making XSS in a content-facing plugin particularly dangerous. Patching should be prioritized within one to two weeks depending on your contributor user base and site criticality.

Risk score, explained

The CVSS 3.1 score of 6.4 (MEDIUM) reflects the requirement for authenticated, contributor-level access (PR:L) and the absence of a direct availability impact (A:N). However, the scope change (S:C) acknowledging the impact on other users, combined with confidentiality and integrity compromise (C:L, I:L), accurately captures the cross-site scripting nature. The score appropriately does not assume widespread exploitation or active weaponization. In practice, risk is contextual: organizations with strict contributor vetting and multi-factor authentication may find this lower-risk; those with many external contributors or weak authentication face higher real-world risk.

Frequently asked questions