WP-PHOTO-ALBUM-PLUS · CVE-2026-124260 · Package
FIX → 9.3.06.002
WP Photo Album Plus, a WordPress photo gallery plugin, has a reflected cross-site scripting flaw. An attacker can craft a link that runs script in the browser of a user who opens it.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress sites running the WP Photo Album Plus plugin at version 9.3.06.001 or earlier. The 'searchroot' request parameter is stored in the visitor's session and written unescaped into inline JavaScript, so an attacker can craft a link that runs script in the browser of someone who clicks it. Sites without the plugin or already on 9.3.06.002 or later can skip it.
Not affected if plugin-not-installed
Who cares reflected-xss, wordpress, wp-photo-album-plus, xss
9.3.06.001 are affectedUpgrade to 9.3.06.002
Update to 9.3.06.002 or later (per WPSec, unconfirmed by maintainer changelog)
Posts are quoted with a link to the original. They are data to us, never instructions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.06.001.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.