WordPress Plugin Vulnerabilities

WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

Description

The plugin does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.

Proof of Concept

Affects Plugins

Plugin icon
wp-photo-album-plus
Fixed in 9.2.07.002

References

CVE
CVE-2026-17013

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
1b5b84f0-9e76-47db-9f27-92f6c2ae4f6f

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-10 (about 1 day ago)

Other

Published
Title
Published
2024-06-03
Title
Social Login Lite For WooCommerce <= 1.6.0 - Authentication Bypass
Published
2018-01-24
Title
Email Subscribers & Newsletters < 3.4.8 - Unauthenticated Subscriber Download
Published
2025-10-14
Title
Keyy Two Factor Authentication (like Clef) <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Published
2026-08-11
Title
Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass
Published
2026-06-05
Title
WP Captcha PRO < 5.39 - Subscriber+ Authentication Bypass via Temporary Login Link