WordPress Plugin Vulnerabilities

Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute

Description

The plugin does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.

Proof of Concept

Affects Plugins

Plugin icon
embed-google-photos-album-easily
No known fix

References

CVE
CVE-2026-14290

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
testoun
Submitter
testoun
Verified
Yes
WPVDB ID
e8fae1ed-59a0-4e64-b82d-26328f460cad

Timeline

Publicly Published
2026-08-11 (about 4 days ago)
Added
2026-08-04 (about 11 days ago)
Last Updated
2026-08-04 (about 11 days ago)

Other

Published
Title
Published
2023-06-20
Title
Contact Form by WPForms < 1.8.1.3 - Reflected XSS
Published
2024-06-28
Title
Events Manager < 6.4.9 - Reflected Cross-Site Scripting
Published
2025-03-03
Title
Form Maker by 10Web < 1.15.30 - Admin+ Stored XSS
Published
2025-12-04
Title
SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2023-04-21
Title
Dave's WordPress Live Search <= 4.8.1 - Admin+ Stored XSS