CVE-2026-14922
Received Received - Intake

Stored XSS in WP Photo Album Plus via Double-Encoding

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `<img src=... onload=...>`) passes the write filters as harmless entity text and is stored one decode-level down (`<img ... onload=...>`).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-14922
EUVD
EUVD-2026-51419

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_photo_album_plus wp_photo_album_plus to 9.2.03.001 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

WP Photo Album Plus has a stored Cross-Site Scripting (XSS) vulnerability in versions up to 9.2.03.001 due to a decode-after-sanitize flaw in the photo-comment system. When a user submits a double HTML-entity-encoded payload, it bypasses sanitization filters and gets stored as partially decoded HTML, which can later execute malicious scripts when rendered.

Detection Guidance

Check for stored comments containing double-encoded HTML entities like <img or > in WP Photo Album Plus. Inspect database tables for wppa_comments or similar. Review server logs for unusual comment submissions.

Impact Analysis

An attacker could exploit this to inject malicious scripts into comments. When other users view the page, the stored payload executes in their browsers, potentially stealing session cookies, redirecting to phishing sites, or performing actions on their behalf without consent.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance breaches if user data is compromised through such attacks.

Mitigation Strategies

Update WP Photo Album Plus to the latest version beyond 9.2.03.001. Temporarily disable comment functionality if an update is unavailable. Implement WAF rules to block double-encoded payloads in comment submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14922. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart