CVE-2026-14922: WP Photo Album Plus XSS Vulnerability

CVE-2026-14922 Overview

CVE-2026-14922 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WP Photo Album Plus WordPress plugin. The flaw affects all versions up to and including 9.2.03.001. The plugin's photo-comment pipeline sanitizes user input in the wrong order, allowing double HTML-entity-encoded payloads to survive the write filters. When the stored comment is later rendered, one layer of decoding restores executable HTML, triggering script execution in the browsers of visitors who view the affected photo page.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript through photo comments, executing arbitrary script in viewers' sessions and enabling session theft, defacement, or redirection.

Affected Products

WP Photo Album Plus WordPress plugin, all versions through 9.2.03.001
WordPress sites exposing the photo-comment feature to unauthenticated visitors
Any deployment relying on wppa_do_comment() for comment sanitization

Discovery Timeline

2026-07-31 - CVE-2026-14922 published to the National Vulnerability Database (NVD)
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-14922

Vulnerability Analysis

The vulnerability is a decode-after-sanitize flaw in the comment write path. In wppa-functions.php:2623-2624, the plugin first calls wppa_filter_html() (a wp_kses wrapper) and then wp_strip_all_tags() on the submitted comment. Both filters operate on the raw string and only recognize real HTML tags. Double HTML-entity-encoded input such as <img src=x onload=...> contains no real tags at the moment of filtering. It passes through as ordinary text and is stored one decode level lower as <img ... onload=...>.

When the stored comment is rendered, the surviving entity layer is decoded by the browser or output pipeline into a live <img> tag with an onload handler. The payload then executes in the context of the site origin. Because comment submission does not require authentication on typical deployments, the attack requires only that a victim view the photo page (UI:R). The scope change (S:C) reflects impact on the victim's browser session beyond the vulnerable component.

Root Cause

The root cause is filter ordering combined with incomplete entity handling. wp_strip_all_tags() removes tags but does not normalize or reject nested entity encoding. Sanitization runs once on the encoded input rather than on the fully decoded form the browser will eventually see.

Attack Vector

An attacker submits a photo comment containing a double-entity-encoded HTML payload through the plugin's public comment form. The write-path filters accept it as inert text. On subsequent renders, the outer entity layer decodes and the injected handler executes JavaScript in every viewer's browser.

No verified exploit code is published. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-14922

Indicators of Compromise

Stored comments in the WP Photo Album Plus database tables containing entity sequences such as <img, <script, <svg, or event handler fragments like onload=, onerror=, onclick=.
Outbound requests from visitor browsers to attacker-controlled domains originating from photo-gallery pages.
Unexpected administrator session activity following visits to comment-enabled photo pages.

Detection Strategies

Query the WordPress comments table for photo-related comments containing HTML entity patterns, specifically < or < followed by tag names or event attributes.
Deploy Content Security Policy (CSP) reporting to capture inline script violations on gallery pages.
Review web server access logs for POST requests to WP Photo Album Plus comment endpoints paired with encoded payloads.

Monitoring Recommendations

Alert on modifications to plugin files under wp-content/plugins/wp-photo-album-plus/.
Monitor for privilege escalation events or new administrator accounts created shortly after gallery page views.
Track anomalous JavaScript execution and DOM modifications reported via browser telemetry or CSP endpoints.

How to Mitigate CVE-2026-14922

Immediate Actions Required

Update WP Photo Album Plus to a version later than 9.2.03.001 once the vendor publishes a fix.
Disable the photo-comment feature in the plugin settings until the patched release is deployed.
Audit existing comments for entity-encoded HTML payloads and purge suspicious entries.

Patch Information

At publication time, no fixed version is referenced in the NVD entry. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for the corrected release. The proper fix must decode input to its canonical form before running wp_kses and wp_strip_all_tags, or reject nested entity encoding outright.

Workarounds

Restrict comment submission to authenticated users via WordPress role or plugin configuration.
Place a Web Application Firewall (WAF) rule in front of the comment endpoint to block requests containing double-encoded entity sequences such as < or <.
Enforce a strict Content Security Policy that disallows inline scripts and event handlers on pages that render photo comments.

bash

# Example WAF pattern to block double-encoded HTML in comment submissions
SecRule ARGS:comment "@rx (?:&lt;|&#0*60;|&#x0*3c;)" \
  "id:1029222,phase:2,deny,status:403,\
   msg:'CVE-2026-14922 double-encoded HTML in wppa comment'"