CVE-2026-10095: WP Photo Album Plus XSS Vulnerability

CVE-2026-10095 Overview

CVE-2026-10095 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WP Photo Album Plus plugin for WordPress. The flaw affects all versions up to and including 9.1.13.005 and stems from insufficient input sanitization and output escaping on the subtext parameter. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when other users, including administrators, view an affected page. Exploitation involves embedding the malicious [photo] shortcode in a post submitted for review, causing the payload to fire during editorial review or general browsing.

Critical Impact
Contributor-level accounts can escalate impact by executing scripts in an administrator's browser session, enabling account takeover, privilege escalation, and defacement.

Affected Products

WP Photo Album Plus plugin for WordPress, all versions through 9.1.13.005
Fixed in WP Photo Album Plus 9.2.01.001
WordPress sites permitting contributor-level or higher user registrations

Discovery Timeline

2026-07-01 - CVE-2026-10095 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-10095

Vulnerability Analysis

The vulnerability resides in the WP Photo Album Plus shortcode handling logic. The plugin exposes a [photo] shortcode that accepts a subtext parameter used to render caption content beneath photo elements. The plugin renders this parameter into page output without adequate sanitization or contextual output escaping, allowing HTML and JavaScript payloads to persist in stored content.

A contributor submits a post containing the [photo] shortcode with a crafted subtext value. When an editor, administrator, or site visitor loads the post, the plugin injects the attacker-controlled string directly into the rendered page. The browser then executes the injected script in the context of the WordPress origin.

Because the payload runs with the privileges of the viewing user, an administrator opening the submitted post for review can trigger actions such as creating new administrative accounts, modifying plugin settings, or exfiltrating nonces and session cookies. Relevant plugin source lines involved in filter and function processing are referenced in the WordPress Plugin Filter Code and WordPress Plugin Functions Code.

Root Cause

The root cause is missing input sanitization and output escaping when processing shortcode attributes. The subtext value flows from user input into rendered HTML without functions such as esc_html(), esc_attr(), or wp_kses() being applied. This is a classic instance of [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation is remote over the network and requires an authenticated account with contributor privileges. No user interaction beyond viewing the injected content is required. The scope is changed, meaning the vulnerable component and the impacted component differ — the plugin renders content that impacts other users' browser sessions. The vulnerability is fixed in the changeset introducing sanitization.

Example shortcode pattern (conceptual, sanitized):
[photo id="..." subtext="<script>/* attacker payload */</script>"]

The plugin renders the subtext value into HTML output without escaping,
causing script execution when the post is viewed by any authenticated
or unauthenticated user.

Detection Methods for CVE-2026-10095

Indicators of Compromise

Posts or pages in wp_posts containing [photo] shortcodes with subtext attributes that include HTML tags, <script> elements, or event handler attributes such as onerror, onload, or onmouseover.
Newly created administrator accounts or role changes shortly after an administrator previews or reviews a contributor-submitted post.
Unexpected outbound requests from admin browser sessions to external hosts referencing WordPress nonces or REST endpoints.

Detection Strategies

Audit the WordPress database for stored [photo] shortcodes that embed script content or unusual HTML in the subtext parameter.
Review the WP Photo Album Plus plugin version reported by WordPress site health and inventory scans; flag any installation at or below 9.1.13.005.
Correlate contributor account activity with subsequent administrator page loads and privileged actions to identify potential exploitation chains.

Monitoring Recommendations

Enable WordPress audit logging to capture post revisions, user role changes, and plugin/user creation events.
Monitor web application firewall telemetry for shortcode payloads containing <, >, or javascript: sequences in subtext values.
Alert on browser-based Content Security Policy (CSP) violations in wp-admin, which may indicate script injection attempts.

How to Mitigate CVE-2026-10095

Immediate Actions Required

Update WP Photo Album Plus to version 9.2.01.001 or later, which contains the sanitization fix referenced in the plugin version change.
Review all posts and pages authored by contributor-level accounts for suspicious [photo] shortcode usage.
Rotate administrator session cookies and reset passwords for any accounts that previewed suspicious posts prior to patching.

Patch Information

The vendor released a fix in WP Photo Album Plus 9.2.01.001. The corrective changes are documented in the WordPress Plugin Changeset 3557877 and additional context is available in the Wordfence Vulnerability Report. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

Restrict contributor role assignment until the plugin is updated; limit content submission privileges to trusted users only.
Deactivate the WP Photo Album Plus plugin until the patched version is deployed if updating is not immediately possible.
Deploy a web application firewall rule to block shortcode attributes containing HTML tags or script keywords in the subtext value.

bash

# Update WP Photo Album Plus via WP-CLI
wp plugin update wp-photo-album-plus --version=9.2.01.001

# Verify installed version
wp plugin get wp-photo-album-plus --field=version

# Temporary mitigation: deactivate the plugin if patching is delayed
wp plugin deactivate wp-photo-album-plus