opajaap vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20251
3. 20267

Newest CVEs

• CVE-2026-92115

  WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action

  opajaap · WP Photo Album Plus

  High8.8
• CVE-2026-96278

  WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History

  opajaap · WP Photo Album Plus

  High7.2
• CVE-2026-87909

  WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

  opajaap · WP Photo Album Plus

  High7.5
• CVE-2026-18579

  WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting

  opajaap · WP Photo Album Plus

  High7.2
• CVE-2026-15344

  WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter

  opajaap · WP Photo Album Plus

  Medium4.9
• CVE-2026-10095

  WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute

  opajaap · WP Photo Album Plus

  Medium6.4
• CVE-2025-14835

  WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting

  opajaap · WP Photo Album Plus

  High7.1
• CVE-2025-8726

  WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload

  opajaap · WP Photo Album Plus

  Medium5.4
• CVE-2024-10958

  WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay

  opajaap · WP Photo Album Plus

  High7.3
• CVE-2024-9951

  Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting

  opajaap · WP Photo Album Plus

  Medium6.1