8.6
High
CVE-2026-6379 The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before…
Description
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Photo Album Plus 9.1 | earliest → < 9.1.11.001 | 9.1.11.001 |
Other CVEs of WP Photo Album Plus
The 10 CVEs of WP Photo Album Plus →
CVE-2026-110983
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its…
4.3
Medium
CVE-2026-110981
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before…
7.1
High
CVE-2026-18962
The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload…
4.3
Medium
CVE-2026-18049
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of…
7.5
High