WP Photo Album Plus

WP Photo Album Plus is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 9.2.08.003.

WP Photo Album Plus before 9.2.09.002 allows wppa_user_upload() to process the request's upload-album value after checking only that the non-default front-end user-upload feature is enabled and the requester is logged in. A Subscriber can target an album owned by another user or an Administrator, and downstream processing writes the file and photo entry there. File types and consequences remain constrained by the plugin's normal upload pipeline and site settings; code execution is not disclosed.

WP Photo Album Plus before 9.2.07.002 exposes wppa_ajax_callback() through wp_ajax_nopriv_wppa and /wp-photo-album-plus/endPoint/. The gettogo action accepts slug, reads get_option(slug + '_togo') and get_option(slug + '_status'), returns both values and deletes the constructed _status option when its value is Ready. Because slug is unrestricted, an unauthenticated attacker can target unrelated autoloaded options ending in those suffixes. Which options are exposed or deleted is installation-dependent; arbitrary option names without a matching suffix are not affected by the disclosed path.

WP Photo Album Plus before 9.2.07.002 exposes wppa_ajax_callback() through wp_ajax_nopriv_wppa and the REST route /wp-photo-album-plus/endPoint/. Its delmyzip action builds a .zip path from WPPA_UPLOAD_PATH, the zips directory and wppa_get_user(), then deletes it without authentication or a nonce. For logged-out users, wppa_get_user() derives a value from client-IP and forwarded-address helpers, providing the client-controlled path component described by WPScan. Traversal can delete arbitrary .zip files, including outside the web root. The accepted header and filesystem prerequisites depend on the deployment.

WP Photo Album Plus before 9.2.07.002 reflects the attacker-controlled gallery or lightbox lbstart parameter into an inline script block without adequate sanitization or escaping. An unauthenticated attacker can craft a gallery-page link that executes script in the site origin when another user opens it. The exact request spelling or pretty-link form, sink function and payload constraints are not disclosed.

WP Photo Album Plus before 9.2.07.002 exposes a public REST action without a capability or nonce check. An unauthenticated attacker can invoke it to delete generated album-export ZIP archives stored by the plugin.

WP Photo Album Plus through 9.2.04.002 is vulnerable in its WordPress AJAX table-export path. The wp_ajax_wppa callback selects wppa-action=export-table and reads the attacker-controlled table request parameter without a nonce. Although the handler requires wppa_user_is_admin(), it passes table to wppa_export_table(), where it is interpolated into DESCRIBE and SELECT COUNT(*) SQL statements without an identifier allowlist or prepared placeholder. An Administrator can therefore append SQL and extract sensitive database information; because the export request has no nonce, an attacker can also trigger the operation by inducing a logged-in Administrator to submit a forged request. Version 9.2.04.003 restricts table to the plugin's seven expected database tables before running the export queries.

WP Photo Album Plus is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 9.2.02.004.

WP Photo Album Plus is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 9.1.13.005.

WP Photo Album Plus is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 9.1.13.005.

WP Photo Album Plus is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 9.1.08.001.

WP Photo Album Plus is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is < 9.1.11.001.

WP Photo Album Plus is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP Photo Album Plus is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

The WP Photo Album Plus is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Photo Album Plus is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP Photo Album Plus is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP Photo Album Plus is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP Photo Album Plus is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Photo Album Plus is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Photo Album Plus is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

WP Photo Album Plus is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

WP Photo Album Plus is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Photo Album Plus is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP Photo Album Plus is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Wp Photo Album Plus is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Wp Photo Album Plus is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.