Plugin icon

WP Photo Album Plus

wp-photo-album-plus

Vulnerabilities:

23

Last Updated:

March 14, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-01-06
Title
WP Photo Album Plus < 9.1.05.009 - Reflected Cross-Site Scripting
Fixed in
Fixed in 9.1.05.009
CVSS
7.1 (high)
Published
2025-10-03
Title
WP Photo Album Plus < 9.0.11.007 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload
Fixed in
Fixed in 9.0.11.007
CVSS
5.4 (medium)
Published
2024-11-10
Title
WP Photo Album Plus < 8.9.01.001 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay
Fixed in
Fixed in 8.9.01.001
CVSS
7.3 (high)
Published
2024-10-16
Title
Wordpress Photo Album Plus < 8.8.07.004 - Reflected Cross-Site Scripting
Fixed in
Fixed in 8.8.07.004
CVSS
6.1 (medium)
Published
2024-07-11
Title
WP Photo Album Plus < 8.8.02.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 8.8.02.003
CVSS
6.4 (medium)
Published
2024-06-28
Title
WP Photo Album Plus < 8.8.00.003 - Reflected Cross-Site Scripting
Fixed in
Fixed in 8.8.00.003
CVSS
6.1 (medium)
Published
2024-05-23
Title
WP Photo Album Plus < 8.7.00.004 - Unauthenticated Arbitrary Shortcode Execution
Fixed in
Fixed in 8.7.00.004
CVSS
6.5 (medium)
Published
2024-05-07
Title
WP Photo Album Plus < 8.7.01.002 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 8.7.01.002
CVSS
10.0 (critical)
Published
2024-04-05
Title
WP Photo Album Plus < 8.6.03.005 - Authenticated (Subscriber+) Arbitrary File Upload
Fixed in
Fixed in 8.6.03.005
CVSS
9.9 (critical)
Published
2023-12-05
Title
WP Photo Album Plus < 8.6.01.005 - Cross-Site Scripting
Fixed in
Fixed in 8.6.01.005
CVSS
6.1 (medium)
Published
2023-12-05
Title
WP Photo Album Plus < 8.6.01.005 - IP Spoofing
Fixed in
Fixed in 8.6.01.005
CVSS
5.3 (medium)
Published
2023-12-05
Title
WP Photo Album Plus < 8.6.01.003 - Insecure Direct Object Reference
Fixed in
Fixed in 8.6.01.003
CVSS
5.3 (medium)
Published
2022-01-02
Title
WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 8.0.10
CVSS
4.8 (medium)
Published
2015-05-20
Title
WP Photo Album Plus <= 6.1.2 - Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 6.1.3
CVSS
n/a
Published
2014-11-24
Title
WP Photo Album Plus 5.4.17 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 5.4.18
CVSS
n/a
Published
2014-09-28
Title
WP Photo Album Plus 5.4.4 & 5.4.3 Cross-Site Scripting (XSS)
Fixed in
Fixed in 5.4.5
CVSS
n/a
Published
2014-09-17
Title
WP Photo Album Plus 5.4.5 - 5.4.8 Stored XSS
Fixed in
Fixed in 5.4.8
CVSS
n/a
Published
2014-08-01
Title
WP Photo Album Plus < 4.2.0 - SQL Injection
Fixed in
Fixed in 4.2.0
CVSS
n/a
Published
2014-08-01
Title
WP Photo Album Plus - Full Path Disclosure
Fixed in
Fixed in 4.9.1
CVSS
n/a
Published
2014-08-01
Title
WP Photo Album Plus - "commentid" Cross-Site Scripting
Fixed in
Fixed in 5.0.3
CVSS
n/a
Published
2014-08-01
Title
WP Photo Album Plus < 4.8.12 - wp-photo-album-plus.php wppa-searchstring XSS
Fixed in
Fixed in 4.8.12
CVSS
n/a
Published
2014-08-01
Title
WP Photo Album Plus - index.php wppa-tag Parameter XSS
Fixed in
Fixed in 4.9.3
CVSS
n/a
Published
2014-08-01
Title
WP Photo Album Plus - wp-admin/admin.php edit_id Parameter XSS
Fixed in
Fixed in 5.0.11
CVSS
n/a