Live › vulnerability › CVE-2026-110981
Go to dashboardThe WP Photo Album Plus WordPress plugin before 9.2.11.002 does not escape a category navigation value before placing it in a JavaScript event handler on gallery breadcrumb links. An unauthenticated attacker can craft a gallery link so that script runs in the browser of anyone who clicks the breadcrumb, including a logged-in administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running WP Photo Album Plus before that display galleries with breadcrumb links. Exposure is through visitors and logged-in administrators who follow a crafted link, so any site with the plugin active on a public-facing gallery page should be checked. Sites without the plugin, or running a fixed version, are not affected.
9.2.11.002No product ranges from the sources yet.
wp-content/plugins/wp-photo-album-plus plugin header9.2.11.002 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-110981")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.