# CVE-2026-110981: WP Photo Album Plus reflected XSS in category navigation

Source: https://junglewise.ai/threats/cve-2026-110981-the-wp-photo-album-plus-wordpress-plugin-before-9-2-11-002-does  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-18. Updated: 2026-10-18  
License: CC BY 4.0 with a link back

CVE-2026-110981 · Severity: info · Published 2026-10-18

WP Photo Album Plus is a WordPress plugin used to display photo galleries on websites. The plugin fails to properly escape user input in category navigation links, allowing attackers to inject malicious scripts that execute when site visitors click breadcrumb links. An attacker could trick administrators or other users into clicking a crafted link that steals session credentials, redirects to phishing pages, or performs unauthorized actions on their behalf.

Technologies: [WP Photo Album Plus](https://junglewise.ai/threats/technologies/photo-album-plus). Vendors: [WP Photo Album Plus](https://junglewise.ai/threats/vendors/wp-photo-album-plus).

## Quick answers

**Is CVE-2026-110981 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110981 being exploited in the wild.

**How severe is CVE-2026-110981?** Informational severity, published 18 October 2026.

**Which products and versions are affected?** WP Photo Album Plus before 9.2.11.002.

**Is there a fix for CVE-2026-110981?** Yes: fixed in 9.2.11.002. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110981 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-110981?** Check whether you run WP Photo Album Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.2.11.002

## Technical details

This is a reflected cross-site scripting (XSS) vulnerability in the wppa-cat parameter used for gallery breadcrumb navigation. The vulnerable component does not escape category values before reflecting them into JavaScript event handlers. An unauthenticated attacker can craft a malicious gallery link containing JavaScript payload in the wppa-cat parameter; when a user visits the link and interacts with the breadcrumb, the injected script executes in their browser context.

## Affected products

- WP Photo Album Plus WP Photo Album Plus before 9.2.11.002

## Timeline

- 2026-10-16: disclosed
- 2026-10-18: advisory

## References

- [https://wpscan.com/vulnerability/8328dd66-924c-4e74-972e-68ce65408159/](https://wpscan.com/vulnerability/8328dd66-924c-4e74-972e-68ce65408159/)

## Related threats

- [WP Photo Album Plus CSRF in comment deletion](https://junglewise.ai/threats/cve-2026-110983-the-wp-photo-album-plus-wordpress-plugin-before-9-3-04-004-does)
- [WP Photo Album Plus authenticated command injection via ImageMagick](https://junglewise.ai/threats/cve-2026-92115-the-wp-photo-album-plus-plugin-for-wordpress-is-vulnerable-to)
- [WP Photo Album Plus stored XSS via X-Forwarded-For parameter](https://junglewise.ai/threats/cve-2026-18579-wp-photo-album-plus-stored-xss-via-x-forwarded-for-parameter)
- [WP Photo Album Plus privilege escalation in file upload](https://junglewise.ai/threats/cve-2026-18962-wp-photo-album-plus-privilege-escalation-in-file-upload)
- [WordPress WP Photo Album Plus unauthenticated option disclosure](https://junglewise.ai/threats/cve-2026-18049-wordpress-wp-photo-album-plus-unauthenticated-option-disclosure)