{"id":"CVE-2026-119477","kind":"vulnerability","aliases":["CVE-2026-119477"],"related":[],"title":"WP Photo Album Plus: stored XSS lets attackers run scripts in pages","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003.","summary":"WP Photo Album Plus, a WordPress photo gallery plugin by Jacob N. Breetvelt, has a stored cross-site scripting flaw in versions up to 9.3.05.003. An attacker can save malicious script into album data that then runs in the browser of anyone who views the page, including logged-in administrators.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-photo-album-plus","fixed":[],"affected":"<= 9.3.05.003","ecosystem":"wordpress"}],"ecosystems":[],"tags":["other","self-hosted","wordpress","wp-photo-album-plus"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Look for the plugin `wp-photo-album-plus` in the WordPress plugins list and note its version.\n- Compare the installed version against `9.3.05.003`; anything at or below it is in the reported range.","fix":null,"status":"open","published_at":"2026-11-04T08:17:16+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","triaged_at":"2026-11-04T08:26:32+00:00","updated_at":"2026-11-04T08:27:35+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-04T08:26:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Photo Album Plus: stored XSS lets attackers run scripts in pages","impact":"medium","summary":"WP Photo Album Plus, a WordPress photo gallery plugin by Jacob N. Breetvelt, has a stored cross-site scripting flaw in versions up to 9.3.05.003. An attacker can save malicious script into album data that then runs in the browser of anyone who views the page, including logged-in administrators.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wp-photo-album-plus","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers, possibly admin sessions.","analyst_note":"Check the NVD entry and the plugin's changelog for a fixed version and the required privilege level to inject the stored payload.","how_to_check":"- Look for the plugin `wp-photo-album-plus` in the WordPress plugins list and note its version.\n- Compare the installed version against `9.3.05.003`; anything at or below it is in the reported range.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running WP Photo Album Plus at version 9.3.05.003 or earlier is in the reported range. The flaw is stored, so the risk is highest where untrusted users can submit album or photo data, and where administrators view that data in the admin area. Sites that do not run the plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4137,"output_tokens":585,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin's changelog for a fixed version and the required privilege level to inject the stored payload.","search":"'-119477':15A,18A '-2026':14A,17A '9.3.05.003':59B,124C 'administr':85B 'affect':116C 'album':3A,22A,32B,36B,67B,105C,110C,119C 'allow':112C 'anyon':76B 'attack':8A,61B 'breetvelt':46B,102C 'browser':74B 'cross':51B,95C 'cross-sit':50B,94C 'cve':13A,16A 'data':68B 'flaw':54B 'galleri':41B 'generat':93C 'host':27B 'improp':86C 'includ':81B 'input':89C 'issu':115C 'jacob':44B,100C 'let':7A 'log':83B 'logged-in':82B 'malici':64B 'n':45B,101C 'n/a':122C 'neutral':87C 'page':12A,80B,92C 'photo':2A,21A,31B,35B,40B,104C,109C,118C 'plugin':42B 'plus':4A,23A,33B,37B,106C,111C,120C 'run':9A,71B 'save':63B 'script':10A,53B,65B,97C 'self':26B 'self-host':25B 'site':52B,96C 'store':5A,49B,113C 'version':56B 'view':78B 'vulner':98C 'web':91C 'wordpress':28B,39B 'wp':1A,20A,30B,34B,103C,108C,117C 'wp-photo-album-plus':19A,29B,107C 'xss':6A 'xss.this':114C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running WP Photo Album Plus at version 9.3.05.003 or earlier is in the reported range. The flaw is stored, so the risk is highest where untrusted users can submit album or photo data, and where administrators view that data in the admin area. Sites that do not run the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wpphotoalbumplus"],"ptokens":["album","photo","plus","wp"],"labels":["high","other","selfhosted","wordpress","wpphotoalbumplus"],"campaign_type":null,"first_public_at":"2026-11-04T08:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119477","severity":null,"published_at":"2026-11-04T08:17:16+00:00","modified_at":"2026-11-04T08:17:16+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","fetched_at":"2026-11-04T08:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119477:1647","url":null,"severity":null,"published_at":"2026-11-04T08:27:35+00:00","modified_at":"2026-11-04T08:27:35+00:00","first_seen_at":"2026-11-04T08:27:35+00:00","fetched_at":"2026-11-04T08:27:35+00:00","note":"NVD (Patchstack-sourced CVSS 7.1, PR:N UI:R) says stored XSS through 9.3.05.003, privilege level not stated in NVD. No vendor advisory or changelog naming a fixed version found; wordpress.org page (modified 2026-10-27) changelog not readable, wpvul lists latest as 9.3.05.002, which conflicts with the range. Fix unknown: settle by reading the plugin changelog/Patchstack entry. Nothing verified. Plugin has many recent XSS CVEs, so update to latest release anyway."}],"documents":[{"id":65458,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119477","title":"NVD CVE-2026-119477","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}