Wp Photo Album Plus

WordPress plugin · wp-photo-album-plus · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Wp Photo Album Plus on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.5	WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal CVE.org	>=0, <9.2.07.002	v9.2.07.002	CVE-2026-18048	Aug 12, 2026
HIGH CVSS 7.5	WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo CVE.org	>=0, <9.2.07.002	v9.2.07.002	CVE-2026-18049	Aug 12, 2026
HIGH CVSS 8.6	WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter CVE.org	>=0, <9.1.11.001	v9.1.11.001	CVE-2026-6379	May 18, 2026
MEDIUM CVSS 4.3	WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization CVE.org	>=0, <9.2.09.002	v9.2.09.002	CVE-2026-18962	Aug 12, 2026
MEDIUM CVSS 6.1	WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart CVE.org	>=0, <9.2.07.002	v9.2.07.002	CVE-2026-17013	Aug 12, 2026
MEDIUM CVSS 5.3	WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips CVE.org	>=0, <9.2.07.002	v9.2.07.002	CVE-2026-17014	Aug 9, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.