What’s Vulnerable › Products
opajaap WP Photo Album Plus vulnerabilities
25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.
Check whether your opajaap WP Photo Album Plus version is affected
Latest opajaap WP Photo Album Plus vulnerabilities
- CVE-2026-110981 — WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter (CVSS 7.1)
- CVE-2026-92115 — WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action (CVSS 8.8)
- CVE-2026-96278 — WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History (CVSS 7.2)
- CVE-2026-87909 — WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection (CVSS 7.5)
- CVE-2026-18579 — WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- CVE-2026-18962 — WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization (CVSS 4.3)
- CVE-2026-18049 — WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo (CVSS 7.5)
- CVE-2026-18048 — WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal (CVSS 7.5)
- CVE-2026-17013 — WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart (CVSS 6.1)
- CVE-2026-17014 — WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips (CVSS 5.3)
- CVE-2026-14922 — WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment (CVSS 6.1)
- CVE-2026-15344 — WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter (CVSS 4.9)
- CVE-2026-10095 — WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute (CVSS 6.4)
- CVE-2026-6379 — WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter (CVSS 8.6)
- CVE-2025-14835 — WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting (CVSS 7.1)
- CVE-2025-8726 — WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload (CVSS 5.4)
- CVE-2024-10958 — WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay (CVSS 7.3)
- CVE-2024-37416 — WordPress WP Photo Album Plus plugin <= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- CVE-2024-38713 — WordPress WP Photo Album Plus plugin <= 8.8.02.002 - Authenticated Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2023-49774 — WordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerability (CVSS 5.3)
- CVE-2024-4037 — WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3)
- CVE-2024-31286 — WordPress WP Photo Album Plus plugin < 8.6.03.005 - Arbitrary File Upload vulnerability (CVSS 9.9)
- CVE-2023-49812 — WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 7.5)
- CVE-2023-49813 — WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
- CVE-2021-25115 — WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS) (CVSS 6.4)