---
id: "CVE-2026-119477"
kind: "vulnerability"
aliases: ["CVE-2026-119477"]
title: "WP Photo Album Plus: stored XSS lets attackers run scripts in pages"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "wp-photo-album-plus", "fixed": [], "affected": "<= 9.3.05.003", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["other", "self-hosted", "wordpress", "wp-photo-album-plus"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-04T08:17:16+00:00"
first_seen_at: "2026-11-04T08:25:59+00:00"
updated_at: "2026-11-04T08:27:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119477", "first_seen_at": "2026-11-04T08:25:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T08:27:35+00:00"}]
---

# WP Photo Album Plus: stored XSS lets attackers run scripts in pages

WP Photo Album Plus, a WordPress photo gallery plugin by Jacob N. Breetvelt, has a stored cross-site scripting flaw in versions up to 9.3.05.003. An attacker can save malicious script into album data that then runs in the browser of anyone who views the page, including logged-in administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-photo-album-plus affected <= 9.3.05.003 fixed ?

## How to check

- Look for the plugin `wp-photo-album-plus` in the WordPress plugins list and note its version.
- Compare the installed version against `9.3.05.003`; anything at or below it is in the reported range.

## Timeline

- 2026-11-04T08:25:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119477
- 2026-11-04T08:27:35+00:00 analyst — NVD (Patchstack-sourced CVSS 7.1, PR:N UI:R) says stored XSS through 9.3.05.003, privilege level not stated in NVD. No vendor advisory or changelog naming a fixed version found; wordpress.org page (modified 2026-10-27) changelog not readable, wpvul lists latest as 9.3.05.002, which conflicts with the range. Fix unknown: settle by reading the plugin changelog/Patchstack entry. Nothing verified. Plugin has many recent XSS CVEs, so update to latest release anyway.

## Documents

- [describes] NVD CVE-2026-119477 https://nvd.nist.gov/vuln/detail/CVE-2026-119477

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_