PT-2026-66708 · Undefined · Undefined
CVE-2026-14922
·
Published
2026-07-31
·
Updated
2026-07-31
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write,
wppa do comment() sanitizes the comment with wppa filter html() (wp kses) followed by wp strip all tags() (wppa-functions.php:2623-2624). Because wp strip all tags() only removes real tags, an attacker who submits a double HTML-entity-encoded payload (e.g. &lt;img src=... onload=...&gt;) passes the write filters as harmless entity text and is stored one decode-level down (<img ... onload=...>).Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined