WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment

Description

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `&lt;img src=... onload=...&gt;`) passes the write filters as harmless entity text and is stored one decode-level down (`<img ... onload=...>`).

The comment is then rendered in the "comten alt display" mode with an **extra decode** that the safe display paths do not apply: `html_entity_decode( convert_smilies( stripslashes( $com['comment'] ) ) )` (`wppa-thumbnails.php:346`). This revives the stored entity text into a live HTML tag, and the plugin's final output filter `wppa_allowed_tags()` (used by `wppa_echo`, `wppa-wrappers.php:852`) **explicitly allows the `onload` and `onclick` event-handler attributes** (`wppa-wrappers.php:827,861,887,928`), so the revived `<img onload>` / `<a onclick>` survives to the page. The comment author only needs Subscriber-level access (commenting requires `is_user_logged_in()`); the script then executes in the browser of every visitor — including administrators — who views the photo's comments, enabling session/admin compromise.

The single-encoded form is neutralized (stripped at write), and `onerror` is stripped by the output filter — the working bypass is specifically the **double-encoded `onload`/`onclick`** vector. The affected display path is gated by the `comten_alt_display` option (default off, `wppa-defaults.php:621`) and by comment approval (per the site's `moderate_comment` policy; logged-in comments auto-approve under the common `logout` policy).