Skip to contentOpajaap Wp Photo Album Plus vulnerabilities
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.3.06.001 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1242607.1 High
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1194777.1 High
- opajaap wp photo album plusWP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRFCVE-2026-1109834.3 Medium
- opajaap wp photo album plusWP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' ParameterCVE-2026-1109817.1 High
- opajaap wp photo album plusWP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX ActionCVE-2026-921158.8 High
- opajaap wp photo album plusWP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session HistoryCVE-2026-962787.2 High
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1023866.5 Medium
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-937747.1 High
- opajaap wp photo album plusWP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument InjectionCVE-2026-879097.5 High
- opajaap wp photo album plusWP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-185797.2 High
- opajaap wp photo album plusWP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing AuthorizationCVE-2026-189624.3 Medium
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogoCVE-2026-180497.5 High
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path TraversalCVE-2026-180487.5 High
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstartCVE-2026-170136.1 Medium
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzipsCVE-2026-170145.3 Medium
- opajaap wp photo album plusWP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo CommentCVE-2026-149226.1 Medium
- opajaap wp photo album plusWP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' ParameterCVE-2026-153444.9 Medium
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-576757.1 High
- opajaap wp photo album plusWP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode AttributeCVE-2026-100956.4 Medium
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerabilityCVE-2026-548297.5 High
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerabilityCVE-2026-395119.3 Critical
- opajaap wp photo album plusWP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' ParameterCVE-2026-6379Public exploit8.6 High
- opajaap wp photo album plusWP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site ScriptingCVE-2025-148357.1 High
- opajaap wp photo album plusWP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_uploadCVE-2025-87265.4 Medium
- opajaap wp photo album plusWP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelayCVE-2024-10958Public exploit7.3 High
- opajaap wp photo album plusWordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site ScriptingCVE-2024-99516.1 Medium
- j.n. breetvelt a.k.a. opajaap wp photo album plusWordPress WP Photo Album Plus plugin <= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2024-374167.1 High
- j.n. breetvelt a.k.a. opajaap wp photo album plusWordPress WP Photo Album Plus plugin <= 8.8.02.002 - Authenticated Stored Cross Site Scripting (XSS) vulnerabilityCVE-2024-387136.5 Medium
- j.n. breetvelt a.k.a. opajaap wp photo album plusWordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerabilityCVE-2023-497745.3 Medium
- opajaap wp photo album plusWP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2024-40376.5 Medium
- j.n. breetvelt a.k.a. opajaap wp photo album plusWordPress WP Photo Album Plus plugin <= 8.7.01.001 - Unauth. Arbitrary File Upload vulnerabilityCVE-2024-3137710.0 Critical
- j.n. breetvelt a.k.a. opajaap wp photo album plusWordPress WP Photo Album Plus plugin < 8.6.03.005 - Arbitrary File Upload vulnerabilityCVE-2024-312869.9 Critical
- j.n. breetvelt a.k.a. opajaap wp photo album plusWordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR)CVE-2023-498125.3 Medium
- j.n. breetvelt a.k.a. opajaap wp photo album plusWordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS)CVE-2023-498137.1 High
- opajaap wp photo album plusWP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)CVE-2021-251156.4 Medium