{"id":"CVE-2026-110981","kind":"vulnerability","aliases":["CVE-2026-110981"],"related":[],"title":"WP Photo Album Plus: category navigation flaw lets attackers run browser script","description":"The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.","summary":"The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not escape a category navigation value before placing it in a JavaScript event handler on gallery breadcrumb links. An unauthenticated attacker can craft a gallery link so that script runs in the browser of anyone who clicks the breadcrumb, including a logged-in administrator.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-photo-album-plus"],"not_affected_if":["fixed-version","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the `wp-content/plugins/wp-photo-album-plus` plugin header\n- Confirm whether the plugin is active on the site, since the flaw is in its gallery breadcrumb output","fix":"- Update WP Photo Album Plus to `9.2.11.002` or later\n- Until updated, disable the plugin on sites that do not need its galleries","status":"open","published_at":"2026-10-18T07:16:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:14+00:00","updated_at":"2026-10-25T03:36:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:36:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Photo Album Plus to `9.2.11.002` or later\n- Until updated, disable the plugin on sites that do not need its galleries","reach":"internet","title":"WP Photo Album Plus: category navigation flaw lets attackers run browser script","impact":"high","summary":"The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not escape a category navigation value before placing it in a JavaScript event handler on gallery breadcrumb links. An unauthenticated attacker can craft a gallery link so that script runs in the browser of anyone who clicks the breadcrumb, including a logged-in administrator.","category":"package","nicknames":[],"who_cares":["wordpress","wp-photo-album-plus","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Script runs in admin browser, enabling session takeover and site control","analyst_note":"Confirm the affected version range and whether a patch release note or the vendor advisory names the fixed build; the source only gives the 'before 9.2.11.002' bound.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the `wp-content/plugins/wp-photo-album-plus` plugin header\n- Confirm whether the plugin is active on the site, since the flaw is in its gallery breadcrumb output","needs_analyst":true,"not_affected_if":["plugin-not-installed","fixed-version"],"who_is_affected":"Sites running WP Photo Album Plus before `9.2.11.002` that display galleries with breadcrumb links. Exposure is through visitors and logged-in administrators who follow a crafted link, so any site with the plugin active on a public-facing gallery page should be checked. Sites without the plugin, or running a fixed version, are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":3354,"output_tokens":660,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110981':15A,18A '-2026':14A,17A '9.2.11.002':37B,92C 'administr':83B,143C 'album':3A,27B,32B,87C 'allow':114C 'anyon':73B,127C 'arbitrari':119C 'attack':9A,59B,116C 'breadcrumb':55B,77B,112C,137C 'browser':11A,71B,125C 'categori':5A,42B,98C 'click':75B,135C 'craft':61B,131C 'cve':13A,16A 'escap':40B,96C 'event':51B,107C 'execut':122C 'flaw':7A 'follow':129C 'galleri':54B,63B,111C,132C 'handler':52B,108C 'host':22B 'includ':78B,138C 'inject':118C 'javascript':50B,106C 'let':8A 'link':56B,64B,113C,133C 'log':81B,141C 'logged-in':80B,140C 'navig':6A,43B,99C 'packag':19B 'photo':2A,26B,31B,86C 'place':46B 'plugin':35B,90C 'plus':4A,28B,33B,88C 'proper':95C 'reflect':102C 'run':10A,68B 'script':12A,67B,120C 'self':21B 'self-host':20B 'unauthent':58B,115C 'valu':44B,100C 'wordpress':23B,34B,89C 'wp':1A,25B,30B,85C 'wp-photo-album-plus':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running WP Photo Album Plus before `9.2.11.002` that display galleries with breadcrumb links. Exposure is through visitors and logged-in administrators who follow a crafted link, so any site with the plugin active on a public-facing gallery page should be checked. Sites without the plugin, or running a fixed version, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110981","severity":null,"published_at":"2026-10-18T07:16:52+00:00","modified_at":"2026-10-19T21:04:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}