CVE-2021-25115: WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-14 · updated 2026-06-17
Weakness: CWE-79

Description

The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.

Affected products

opajaap WP Photo Album Plus: before 8.0.10.006 — fixed in 8.0.10.006

How to fix

Upgrade to a fixed version: opajaap WP Photo Album Plus 8.0.10.006. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset/2655859/wp-photo-album-plus
https://wpscan.com/vulnerability/dbc18c2c-7547-44fc-8a41-c819757e47a7
https://plugins.trac.wordpress.org/changeset/2655859/wp-photo-album-plus
https://wpscan.com/vulnerability/dbc18c2c-7547-44fc-8a41-c819757e47a7

Get alerted when CVE-2021-25115 or the next vulnerability affects your stack