CVE-2026-110983Medium· 4.3▾ SunlitThe WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comm…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
wp_photo_album_plus < 9.3.04.004Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110981High· 7.1WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
CVE-2026-92115High· 8.8The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action
CVE-2026-96278High· 7.2The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping
CVE-2026-87909High· 7.5The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function
CVE-2026-18579High· 7.2WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting
CVE-2025-14117Medium· 4.3A vulnerability has been found in fit2cloud Halo 2.21.10