← CVE Intelligence

CVE-2026-110981

WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter PUBLISHED

Description (CNA)

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.

Affected (CNA)

Vendor / productVersions
Unknown / WP Photo Album Plusaffected 0 before 9.2.11.002

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.