CVE-2026-110981
7.1HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Attackers can run arbitrary JavaScript in a victim's browser, potentially hijacking an administrator session. This requires an unauthenticated attacker to trick a user into following a crafted link and clicking a breadcrumb.
Root cause
The plugin reflects an unescaped category navigation value directly into a JavaScript event handler on gallery breadcrumb links.
Affected systems
WP Photo Album Plus WordPress plugin before 9.2.11.002
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade the WP Photo Album Plus plugin to version 9.2.11.002 or later. If patching immediately is not possible, deactivate the plugin until it can be updated.
$ wp plugin update wp-photo-album-plus --version=9.2.11.002AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.