{"id":"CVE-2026-124260","kind":"vulnerability","aliases":["CVE-2026-124260"],"related":[],"title":"WP Photo Album Plus: reflected XSS lets attackers run scripts in visitors' browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.06.001.","summary":"WP Photo Album Plus, a WordPress photo gallery plugin, has a reflected cross-site scripting flaw. An attacker can craft a link that runs script in the browser of a user who opens it.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-photo-album-plus","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"wp-photo-album-plus","fixed":["9.3.06.002"],"affected":"<= 9.3.06.001","ecosystem":"wordpress"}],"ecosystems":["vendor"],"tags":["package","reflected-xss","wordpress","wp-photo-album-plus","xss"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check the WP Photo Album Plus version; versions <= 9.3.06.001 are affected. From a shell: wp plugin get wp-photo-album-plus --field=version. Only matters if the plugin is active.","fix":"Update to 9.3.06.002 or later (per WPSec, unconfirmed by maintainer changelog)","status":"open","published_at":"2026-11-13T15:17:35+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:48:40+00:00","updated_at":"2026-11-13T15:51:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:48:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Photo Album Plus: reflected XSS lets attackers run scripts in visitors' browsers","impact":"medium","summary":"WP Photo Album Plus, a WordPress photo gallery plugin, has a reflected cross-site scripting flaw. An attacker can craft a link that runs script in the browser of a user who opens it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-photo-album-plus"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in a visitor's browser, session data stolen","analyst_note":"Find the fixed version and the affected parameter from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124260 or the WordPress plugin changelog.","how_to_check":"- Check the installed version of the `wp-photo-album-plus` plugin in the WordPress admin under Plugins.\n- Confirm whether the plugin is active on the site.","plain_action":"","product_name":"wp-photo-album-plus","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running WP Photo Album Plus up to and including version 9.3.06.001 may be exposed. The sources do not say which page or parameter is affected, or whether logged-out visitors can trigger it. Sites without the plugin can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4566,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the affected parameter from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124260 or the WordPress plugin changelog.","search":"'-124260':16A,19A '-2026':15A,18A '9.3.06.001':113C 'affect':105C 'album':3A,23A,28A,38B,43B,94C,99C,108C 'allow':101C 'attack':8A,59B 'breetvelt':91C 'browser':13A,69B 'craft':61B 'cross':54B,84C 'cross-sit':53B,83C 'cve':14A,17A 'flaw':57B 'galleri':48B 'generat':82C 'improp':75C 'input':78C 'issu':104C 'jacob':89C 'let':7A 'link':63B 'n':90C 'n/a':111C 'neutral':76C 'open':74B 'packag':30B 'page':81C 'photo':2A,22A,27A,37B,42B,47B,93C,98C,107C 'plugin':49B 'plus':4A,24A,29A,39B,44B,95C,100C,109C 'reflect':5A,32B,52B,102C 'reflected-xss':31B 'run':9A,65B 'script':10A,56B,66B,86C 'site':55B,85C 'user':72B 'visitor':12A 'vulner':87C 'web':80C 'wordpress':34B,46B 'wp':1A,21A,26A,36B,41B,92C,97C,106C 'wp-photo-album-plus':20A,25A,35B,96C 'xss':6A,33B,40B 'xss.this':103C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the WP Photo Album Plus plugin at version 9.3.06.001 or earlier. The 'searchroot' request parameter is stored in the visitor's session and written unescaped into inline JavaScript, so an attacker can craft a link that runs script in the browser of someone who clicks it. Sites without the plugin or already on 9.3.06.002 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wpphotoalbumplus"],"ptokens":["album","photo","plus","wp"],"labels":["high","package","reflectedxss","vendor","wordpress","wpphotoalbumplus","xss"],"campaign_type":null,"search_a":"'-124260':16A,19A '-2026':15A,18A 'album':3A,23A,28A 'attack':8A 'browser':13A 'cve':14A,17A 'let':7A 'photo':2A,22A,27A 'plus':4A,24A,29A 'reflect':5A 'run':9A 'script':10A 'visitor':12A 'wp':1A,21A,26A 'wp-photo-album-plus':20A,25A 'xss':6A","search_b":"'album':38B,43B 'attack':59B 'browser':69B 'craft':61B 'cross':54B 'cross-sit':53B 'flaw':57B 'galleri':48B 'link':63B 'open':74B 'packag':30B 'photo':37B,42B,47B 'plugin':49B 'plus':39B,44B 'reflect':32B,52B 'reflected-xss':31B 'run':65B 'script':56B,66B 'site':55B 'user':72B 'wordpress':34B,46B 'wp':36B,41B 'wp-photo-album-plus':35B 'xss':33B,40B","search_c":"'9.3.06.001':113C 'affect':105C 'album':94C,99C,108C 'allow':101C 'breetvelt':91C 'cross':84C 'cross-sit':83C 'generat':82C 'improp':75C 'input':78C 'issu':104C 'jacob':89C 'n':90C 'n/a':111C 'neutral':76C 'page':81C 'photo':93C,98C,107C 'plus':95C,100C,109C 'reflect':102C 'script':86C 'site':85C 'vulner':87C 'web':80C 'wp':92C,97C,106C 'wp-photo-album-plus':96C 'xss.this':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124260","severity":null,"published_at":"2026-11-13T15:17:35+00:00","modified_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124260:3897","url":"https://wpsec.com/vuln/WPSEC-2026-2719/","severity":null,"published_at":"2026-11-13T15:51:06+00:00","modified_at":"2026-11-13T15:51:06+00:00","first_seen_at":"2026-11-13T15:51:06+00:00","fetched_at":"2026-11-13T15:51:06+00:00","note":"NVD page returned nothing. HOL Guard maps this CVE to <= 9.3.06.001. WPSec WPSEC-2026-2719 (a third-party tracker, not the maintainer; no CVE id on its page) describes an unauthenticated reflected XSS via 'searchroot' with the same range and a fix in 9.3.06.002. Nothing verified: no maintainer or vendor page read. Not confirmed that WPSec and this CVE are the same issue.","cites":["https://wpsec.com/vuln/WPSEC-2026-2719/","https://hol.org/guard/security/cves/CVE-2026-124260-wordpress-wp-photo-album-plus-plugin-9306001"]}],"documents":[{"id":147280,"url":"https://wpsec.com/vuln/WPSEC-2026-2719/","title":"WPSec: WP Photo Album Plus <= 9.3.06.001 reflected XSS via searchroot","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":147281,"url":"https://hol.org/guard/security/cves/CVE-2026-124260-wordpress-wp-photo-album-plus-plugin-9306001","title":"HOL Guard: CVE-2026-124260","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}