CVE-2026-18579
Received Received - Intake

Stored XSS in WP Photo Album Plus WordPress Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: Wordfence

Description
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce failure path for the getshortcodedrenderedfenodelay action serves as the log-write trigger rather than an access barrier — a deliberately failed nonce check causes wppa_log() to record the attacker-supplied X-Forwarded-For value to disk, making the exploit fully reachable by unauthenticated callers via the wp_ajax_nopriv_wppa endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-18579
EUVD
EUVD-2026-75953

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_photo_album_plus wp_photo_album_plus to 9.2.08.003 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Photo Album Plus plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability due to insufficient input sanitization and output escaping in the HTTP_X_FORWARDED_FOR parameter. This allows unauthenticated attackers to inject malicious scripts into pages. The vulnerability is triggered through a failed nonce check in the getshortcodedrenderedfenodelay action, which writes attacker-controlled data to logs via the wppa_log() function. Exploits can be executed by unauthenticated users through the wp_ajax_nopriv_wppa endpoint.

Detection Guidance

Check for unauthorized script injections in HTTP headers or logs. Inspect WordPress plugin files for the WP Photo Album Plus plugin, particularly versions up to 9.2.08.003. Look for suspicious entries in the X-Forwarded-For header or wppa_log entries.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into your WordPress site. If exploited, these scripts can steal user data, session cookies, or perform actions on behalf of users. Visitors to your site could have their information compromised without any interaction required. The impact includes potential data breaches, unauthorized access, and damage to your site's reputation.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing user data to unauthorized parties. GDPR requires protecting personal data, and a breach could result in fines. HIPAA mandates safeguarding protected health information, and this vulnerability could allow unauthorized access. Organizations may face legal penalties and reputational damage if exploited.

Mitigation Strategies

Update the WP Photo Album Plus plugin to the latest version beyond 9.2.08.003. If an update is unavailable, consider disabling the plugin temporarily. Review server logs for signs of exploitation and remove any injected scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart