WP-PHOTO-ALBUM-PLUS · CVE-2026-119477 · Other
NO FIX YET
WP Photo Album Plus, a WordPress photo gallery plugin by Jacob N. Breetvelt, has a stored cross-site scripting flaw in versions up to 9.3.05.003. An attacker can save malicious script into album data that then runs in the browser of anyone who views the page, including logged-in administrators.
first public Nov 4, 2026 · 2 sources
Running Wp-photo-album-plus? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any WordPress site running WP Photo Album Plus at version 9.3.05.003 or earlier is in the reported range. The flaw is stored, so the risk is highest where untrusted users can submit album or photo data, and where administrators view that data in the admin area. Sites that do not run the plugin can skip it.
Not affected if plugin-not-installed
Who cares self-hosted, wordpress, wp-photo-album-plus
wp-photo-album-plus in the WordPress plugins list and note its version.9.3.05.003; anything at or below it is in the reported range.No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003.
This page as .md · .json · in your agent: get_signal("CVE-2026-119477") · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.