Opajaap Wp Photo Album Plus
11 CVEs affecting Opajaap Wp Photo Album Plus. Latest disclosed: 2026-10-16. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92115 | High | 8.8 | 2026-10-16 | The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value`… |
CVE-2026-87909 | High | 7.5 | 2026-09-19 | The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insuffic… |
CVE-2024-10958 | High | 7.3 | 2024-11-10 | The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions… |
CVE-2026-96278 | High | 7.2 | 2026-10-10 | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including… |
CVE-2026-18579 | High | 7.2 | 2026-09-11 | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and i… |
CVE-2025-14835 | High | 7.1 | 2026-01-07 | The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including… |
CVE-2024-4037 | Medium | 6.5 | 2024-05-24 | The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to th… |
CVE-2026-10095 | Medium | 6.4 | 2026-07-01 | The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext' parameter in all versions up to, and including, 9.1… |
CVE-2024-9951 | Medium | 6.1 | 2024-10-17 | The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including… |
CVE-2025-8726 | Medium | 5.4 | 2025-10-04 | The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input s… |
CVE-2026-15344 | Medium | 4.9 | 2026-07-29 | The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002… |