Advisories · Technology
WP Photo Album Plus.
Every CVE that names WP Photo Album Plus among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
- WP Photo Album Plus
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
- WP Photo Album Plus
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization
- WP Photo Album Plus
- Broken access control
- CVSS 7.5 High
WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo
- WP Photo Album Plus
- Information disclosure
- CVSS 7.5 High
WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal
- WP Photo Album Plus
- Path traversal
- CVSS 6.1 Medium
WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart
- WP Photo Album Plus
- Cross-site scripting (XSS)
- Authentication bypass
- CVSS 5.3 Medium
WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips
- WP Photo Album Plus
- Path traversal
- CVSS 6.1 Medium
WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment
- WP Photo Album Plus
- Cross-site scripting (XSS)
- CVSS 8.6 High
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter
- WP Photo Album Plus
- SQL injection
-
WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)
- WP Photo Album Plus
- Cross-site scripting (XSS)