CVE-2026-110983
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
Risk Assessment
An attacker can delete photo comments, potentially leading to data loss or vandalism. The risk affects sites with the plugin and users who have comment moderation rights.
Recommendation
Update the WP Photo Album Plus plugin to version 9.3.04.004 or later. Inform moderators about the risk and consider restricting their permissions until updated.
Other vulnerabilities in WP Photo Album Plus WordPress plugin
See all- CVE-2026-6379High
The WP Photo Album Plus WordPress plugin before version 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- CVE-2026-92115High
The WP Photo Album Plus plugin for WordPress (versions up to and including 9.3.02.002) is vulnerable to command injection via the 'value' parameter in the 'update-photo' AJAX action. Insufficient shell escaping in the wppa_image_magick_a() function allows an authenticated user with the wppa_upload capability to execute arbitrary OS commands as the web server user. ImageMagick must be enabled.
- CVE-2026-17014Medium
The WP Photo Album Plus WordPress plugin before version 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.
- CVE-2026-14922Medium
The WP Photo Album Plus plugin up to version 9.2.03.001 is vulnerable to stored Cross-Site Scripting (XSS) due to a double-encoding flaw in the photo comment pipeline. An attacker can submit a double HTML-entity-encoded payload (e.g., <img src=... onload=...>) that passes filters and is stored, then executes in the victim's browser.
Original NVD description (English source)
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS