CVE-2026-14922— WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP Photo Album Plus | < 9.2.04.003 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14922
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment
Source: CVE Program / CVE List V5
Vulnerability Description
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `&lt;img src=... onload=...&gt;`) passes the write filters as harmless entity text and is stored one decode-level down (`<img ... onload=...>`).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Jacob N. Breetvelt WP Photo Album Plus 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Jacob N. Breetvelt WP Photo Album Plus是荷兰Jacob N. Breetvelt个人开发者的一款高度可定制且功能强大的 WordPress 多媒体管理与图库展示插件。 Jacob N. Breetvelt WP Photo Album Plus 9.2.03.001及之前版本存在跨站脚本漏洞，该漏洞源于照片评论处理流程中的清理后解码（双重编码）缺陷，可能导致存储型跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Photo Album Plus | 0 ~ 9.2.04.003 | - |
II. Public POCs for CVE-2026-14922
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14922
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14922 (1)
- 🔗 WP Photo Album Plus < 9.2.04.003 – Subscriber+ Stored XSS via Photo Comment | CVE 2026-14922 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-31 · 34 CVEs total
| CVE-2026-12721 | Kirki < 6.0.13 - Unauthenticated SQL Injection | |
| CVE-2026-14930 | JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload | |
| CVE-2026-15381 | WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter | |
| CVE-2026-15209 | JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Supp | |
| CVE-2026-15258 | Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter | |
| CVE-2026-12251 | Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field | |
| CVE-2026-8155 | BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR | |
| CVE-2026-12376 | Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST | |
| CVE-2026-12720 | Kirki < 6.0.13 - Unauthenticated PHP Object Injection | |
| CVE-2026-14931 | JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure | |
| CVE-2026-13393 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Sett | |
| CVE-2026-13392 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget B | |
| CVE-2026-14862 | Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Autho | |
| CVE-2026-14919 | ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset | |
| CVE-2026-12697 | wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR | |
| CVE-2026-12695 | miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret | |
| CVE-2026-13609 | Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Fo | |
| CVE-2026-14333 | Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive | |
| CVE-2026-14929 | JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR | |
| CVE-2026-15048 | GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: WP Photo Album Plus
- CVE-2026-15344
WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administr - CVE-2026-57675
WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross S - CVE-2026-10095
WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contribut - CVE-2026-54829
WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Inj - CVE-2026-39511
WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Inj
Same vendor: Unknown
- CVE-2026-15239
Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthen - CVE-2026-15211
Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via A - CVE-2026-15148
WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass a - CVE-2026-16258
Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injec - CVE-2026-16265
WP Maps < 4.9.7 - Subscriber+ Denial of Service
V. Comments for CVE-2026-14922
No comments yet