CVE-2025-8726: falha de média gravidade em opajaap WP Photo Album Plus
WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.2%
The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppa_user_upload function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in the photo album descriptions that execute in a victim's browser.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
opajaap · WP Photo Album PlusCVEs relacionadas — opajaap WP Photo Album Plus
No mesmo produto, das mais perigosas para as menos.
CVE-2024-10958HIGHWP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelayEPSS 1.6%CVE-2026-92115HIGHWP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX ActionEPSS 1.4%CVE-2026-87909HIGHWP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument InjectionEPSS 0.9%CVE-2026-15344MEDIUMWP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' ParameterEPSS 0.6%CVE-2026-18579HIGHWP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-4037MEDIUMWP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%