opajaap WP Photo Album Plus

• CVE-2026-92115 High 8.8 WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action 1.4%
• CVE-2026-96278 High 7.2 WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History 0.3%
• CVE-2026-87909 High 7.5 WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection 0.9%
• CVE-2026-18579 High 7.2 WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting 0.5%
• CVE-2026-15344 Medium 4.9 WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter 0.6%
• CVE-2026-10095 Medium 6.4 WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute 0.4%
• CVE-2025-14835 High 7.1 WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting 0.3%
• CVE-2025-8726 Medium 5.4 WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload 0.2%
• CVE-2024-10958 High 7.3 WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay 1.6%
• CVE-2024-9951 Medium 6.1 Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting 0.3%
• CVE-2024-4037 Medium 6.5 WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution 0.5%