CVE-2024-4037mediumCWE-94

CVE-2024-4037: medium-severity vulnerability in opajaap WP Photo Album Plus

WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution

Published · Updated

Follow this CVE+ Monitor WP Photo Album Plus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.5%
The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to the plugin allowing unauthenticated users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
opajaap · WP Photo Album Plus
Related CVEs — opajaap WP Photo Album Plus

In the same product, most dangerous first.

CVE-2024-10958HIGHWP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelayEPSS 1.6%CVE-2026-92115HIGHWP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX ActionEPSS 1.4%CVE-2026-87909HIGHWP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument InjectionEPSS 0.9%CVE-2026-15344MEDIUMWP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' ParameterEPSS 0.6%CVE-2026-18579HIGHWP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-10095MEDIUMWP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode AttributeEPSS 0.4%