CVE-2026-14922

Medium

Description

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `&lt;img src=... onload=...&gt;`) passes the write filters as harmless entity text and is stored one decode-level down (`<img ... onload=...>`).

SeverityMedium

CVSS6.1

Exploit probability—

ProductWP Photo Album Plus

PublishedJul 31, 2026

First seenJul 31, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

WP Photo Album Plus9.2.04.003 or later

Affected products

Product	Affected versions	Fixed in
WP Photo Album Plus	v < 9.2.04.003	9.2.04.003

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.