WP Photo Album Plus is a WordPress plugin that manages image galleries and albums; its vulnerability profile centers on web-application input-handling weaknesses including cross-site scripting, code injection, and authorization-bypass flaws that are typical of user-facing content-management extensions. The plugin's tight scope and WordPress-ecosystem role mean defenders should treat it as a focused component rather than a vendor-wide trend, with remediation priority depending on site exposure and user roles. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wppa over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-10958HIGH The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, | Nov 10, 2024 | 7.3 | 25 | NO | NO |
CVE-2021-25115MEDIUM The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unaut | Feb 14, 2022 | 6.4 | 22 | NO | NO |
CVE-2024-4037HIGH The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to the plugin allowing una | May 24, 2024 | 7.3 | 21 | NO | NO |
CVE-2023-49812HIGH Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02. | Dec 19, 2023 | 7.5 | 21 | NO | NO |
CVE-2024-37416MEDIUM Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Reflected XSS. | Jul 22, 2024 | 6.1 | 18 | NO | NO |
CVE-2023-49813MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue | Dec 14, 2023 | 6.1 | 17 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wppa.
Media articles that mention a CVE ID that affects a product developed by Wppa — matched by CVE ID, not by vendor name.