CVE-2021-25115

WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)

State: Published
Severity: Not scored
Published: Feb 14, 2022
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.

Scores

The record has no CVSS score.

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
WP Photo Album PlusUnknown	8.0.10 to before 8.0.10Affected

References

https://wpscan.com/vulnerability/dbc18c2c-7547-44fc-8a41-c819757e47a7
https://plugins.trac.wordpress.org/changeset/2655859/wp-photo-album-plus

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.