Advisories · Technology

opajaap WP Photo Album Plus.

Every CVE that names opajaap WP Photo Album Plus among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-92115 CVE record

CVSS 8.8 High

WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action
- opajaap WP Photo Album Plus
- Command injection
Not analysed yet 16 Oct 2026
CVE-2026-96278 CVE record

CVSS 7.2 High

WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
- opajaap WP Photo Album Plus
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-87909 CVE record

CVSS 7.5 High

WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection
- opajaap WP Photo Album Plus
- Other injection
Not analysed yet 19 Sept 2026
CVE-2026-18579 CVE record

CVSS 7.2 High

WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting
- opajaap WP Photo Album Plus
- Cross-site scripting (XSS)
Not analysed yet 11 Sept 2026
CVE-2026-15344 CVE record

CVSS 4.9 Medium

WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
- opajaap WP Photo Album Plus
- SQL injection
Not analysed yet 29 Jul 2026
CVE-2026-10095 CVE record

CVSS 6.4 Medium

WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute
- opajaap WP Photo Album Plus
- Cross-site scripting (XSS)
Not analysed yet 1 Jul 2026
CVE-2025-14835 CVE record

CVSS 7.1 High

WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting
- opajaap WP Photo Album Plus
- Cross-site scripting (XSS)
Not analysed yet 7 Jan 2026
CVE-2025-8726 CVE record

CVSS 5.4 Medium

WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload
- opajaap WP Photo Album Plus
- Cross-site scripting (XSS)
Not analysed yet 4 Oct 2025
CVE-2024-10958 CVE record

CVSS 7.3 High

WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay
- opajaap WP Photo Album Plus
- Code injection
Not analysed yet 10 Nov 2024
CVE-2024-9951 CVE record

CVSS 6.1 Medium

Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting
- opajaap WP Photo Album Plus
- Cross-site scripting (XSS)
Not analysed yet 17 Oct 2024
CVE-2024-4037 CVE record

CVSS 6.5 Medium

WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution
- opajaap WP Photo Album Plus
- Code injection
Not analysed yet 24 May 2024