CVE-2026-18579

WP Photo Album Plus, a WordPress photo gallery plugin, is vulnerable to stored cross-site scripting in all versions up to and including 9.2.08.003 because it fails to sufficiently sanitize and escape the attacker-controlled HTTP X-Forwarded-For header. An unauthenticated attacker sends a request to the wp_ajax_nopriv_wppa endpoint invoking the getshortcodedrenderedfenodelay action with a crafted X-Forwarded-For value; a deliberately failed nonce check acts as the log-write trigger rather than an access barrier, causing the plugin's wppa_log() routine to write the malicious header value to its log on disk. The injected script then executes whenever a user, such as an administrator viewing pages that render the plugin's stored log output, accesses an injected page, letting the attacker run arbitrary web script in that user's browser session. Any WordPress site running WP Photo Album Plus version 9.2.08.003 or earlier is affected, with practical exposure concentrated on sites where the plugin's logged data is rendered to privileged users. As of this analysis the flaw is not in the CISA KEV catalog, no public proof-of-concept is known, and no confirmed in-the-wild exploitation has been reported.

What to do: Update WP Photo Album Plus to the latest release beyond version 9.2.08.003 as soon as practical. As interim mitigation, filter or normalize unusual X-Forwarded-For values at the proxy or WAF layer and consider restricting unauthenticated admin-ajax.php requests targeting the plugin's wppa action. After upgrading, review and clear the plugin's log entries for injected HTML/script tags delivered via X-Forwarded-For and check recent admin sessions for signs of compromise.