Wp Photo Album Plus
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wp_photo_album_plus:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wp Photo Album Plus (d15e8dd6-32d8-5309-904f-9b312b501abb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-110983 |
vulnerable | 2026-11-03 10:16:01.045624 |
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
Published: 2026-10-29T06:00:25.116Z
Updated: 2026-10-29T10:56:06.731Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110981 |
vulnerable | 2026-11-03 10:16:00.873265 |
WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.
Published: 2026-10-18T06:00:16.701Z
Updated: 2026-10-18T11:12:29.980Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-18048 |
vulnerable | 2026-09-16 04:34:02.258843 |
WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
Published: 2026-08-12T06:00:16.626Z
Updated: 2026-08-12T19:41:59.317Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-18049 |
vulnerable | 2026-09-16 04:34:01.990086 |
WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
Published: 2026-08-12T06:00:16.799Z
Updated: 2026-08-12T16:06:28.661Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-18962 |
vulnerable | 2026-09-16 04:34:01.600372 |
WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.
Published: 2026-08-12T06:00:18.323Z
Updated: 2026-08-12T12:28:17.858Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14922 |
vulnerable | 2026-09-16 04:33:12.030446 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17014 |
vulnerable | 2026-09-16 04:33:03.797306 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17013 |
vulnerable | 2026-09-16 04:33:03.388645 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-6379 |
vulnerable | 2026-06-08 08:07:04.717814 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25115 |
vulnerable | 2026-06-08 05:30:39.990971 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.