The digital landscape relies heavily on plugins and extensions to add functionality to websites. However, these components can sometimes introduce security risks. One such instance recently came to light involving the popular WP Photo Album Plus plugin for WordPress, which was found to have a Stored Cross-Site Scripting (XSS) vulnerability.
This flaw meant that certain types of malicious code could be saved onto a website using the plugin. Later, when an administrator or another user viewed an affected page, this hidden code would run in their browser. Think of it like a hidden message in a publicly viewable log that, when read, could perform actions on behalf of the person reading it. The concerning part was that anyone, even someone who wasn’t logged into the website, could exploit this to trigger the attack in the admin area. This could potentially give attackers unauthorized control over parts of the website by tricking an admin’s browser into executing harmful scripts.
CVE Details
- Product Name: WP Photo Album Plus (WordPress Plugin)
- CVE ID: CVE-2021-25115
- Published Date: February 14, 2022
- Last Modified: March 20, 2026
Affected Products
The vulnerability impacts the WP Photo Album Plus plugin for WordPress. Specifically, all versions of the plugin before version 8.0.10 are affected. If you are running an older version, your website could be at risk.
Current Status
This vulnerability has been thoroughly analyzed. Details regarding its nature and potential impact are well-documented, allowing for informed mitigation.
Severity Level
The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a score of 6.4, categorizing it as Medium severity. While not as critical as a “High” or “Critical” rating, a Medium severity XSS vulnerability can still pose significant risks. If exploited, it could lead to unauthorized actions performed by an authenticated user’s browser, data theft (like session cookies), or even defacement of web pages. Given that it could affect the admin panel and be triggered by unauthenticated users, it’s a serious concern for website security.
Possible Solutions
The good news is that a fix for this Stored XSS vulnerability is available. To protect your WordPress website, it is crucial to update the WP Photo Album Plus plugin immediately.
Recommendation: Update your WP Photo Album Plus plugin to version 8.0.10 or later. The changeset information indicates that version 8.1.00.001, released around January 11, 2022, includes the necessary patches to address this specific issue. Always ensure you back up your website before performing any plugin updates.
References
https://plugins.trac.wordpress.org/changeset/2655859/wp-photo-album-plus
https://wpscan.com/vulnerability/dbc18c2c-7547-44fc-8a41-c819757e47a7
