Executive brief
WP Photo Album Plus, a WordPress plugin used for managing and displaying photo galleries, contains a security vulnerability in its comment system. An attacker with a basic user account can submit a specially crafted comment that, when viewed by other users or administrators, executes malicious code in their browser. This could allow an attacker to hijack administrative sessions, steal sensitive information, or perform unauthorized actions on the website.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in WP Photo Album Plus up to version 9.2.03.001 due to a 'decode-after-sanitize' flaw. The `wppa_do_comment()` function uses `wp_kses` and `wp_strip_all_tags()` to sanitize input; however, these filters can be bypassed using double HTML-entity-encoded payloads (e.g., using &lt; instead of <). When the comment is rendered in 'comten alt display' mode, the plugin performs an extra `html_entity_decode()`, reviving the malicious tags. Furthermore, the plugin's output filter `wppa_allowed_tags()` explicitly permits `onload` and `onclick` event handlers, allowing the revived payload to execute. This requires Subscriber-level authentication and the `comten_alt_display` option to be enabled. The issue is fixed in version 9.2.04.003.
Affected products
- Unknown WP Photo Album Plus up to, and including, 9.2.03.001
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD published CVE-2026-14922
- 2026-07-31: patched: Fixed in version 9.2.04.003