CVE-2026-110981: WP Photo Album Plus Reflected XSS via Breadcrumb Category Parameter

Overview

A reflected cross-site scripting (XSS) vulnerability has been disclosed in WP Photo Album Plus, a gallery management plugin for WordPress with over 10,000 active installations. Tracked as CVE-2026-110981 (CVSS 7.1, High), the flaw stems from the plugin's gallery breadcrumb navigation, which reflects a category value directly into a JavaScript event handler without escaping it. An attacker who crafts a malicious gallery link and gets a victim to click through the breadcrumb can execute arbitrary script in that victim's browser — including an administrator's.

The bug was assigned by WPScan and affects all versions of the plugin before 9.2.11.002.

Technical Details

How It Works

WP Photo Album Plus renders a breadcrumb trail above each gallery so visitors can navigate back through nested photo album categories. The breadcrumb links are built using the wppa-cat request parameter, which the plugin inserts into an inline JavaScript event handler to control client-side navigation state.

The plugin does not sanitize or encode this value before embedding it in the handler. An attacker can set wppa-cat to a value containing attacker-controlled JavaScript, craft a link to any public gallery page on the target site, and distribute that link via phishing, forum posts, or malicious ads. When a victim loads the page and interacts with the breadcrumb, the injected script executes in the context of the vulnerable site — with no authentication needed on the attacker's part and no vulnerable account required on the victim's side.

Impact Assessment

Who Is At Risk

Any WordPress site running WP Photo Album Plus prior to 9.2.11.002 with publicly accessible galleries is exposed. At time of publication, the plugin's most recent widely-deployed release predates the fix, meaning a meaningful share of its install base is still vulnerable until site owners manually update.

Potential Attack Chains

1. Craft the Payload — Attacker builds a gallery URL with a malicious wppa-cat value containing a script payload
2. Distribute the Link — Link is shared via phishing email, social media, or a compromised referring site
3. Victim Interaction — Victim opens the link and clicks the breadcrumb navigation on the gallery page
4. Script Execution — Injected JavaScript runs in the victim's browser session on the vulnerable site

If the victim is a logged-in administrator or editor, the attacker's script runs with that user's session privileges — enabling session hijacking, unauthorized content changes, or creation of rogue admin accounts, depending on what actions the injected script performs.

Mitigation

Immediate Actions

• Update WP Photo Album Plus to version 9.2.11.002 or later via the WordPress plugin dashboard
• If immediate updating isn't possible, consider restricting public access to gallery pages or disabling the plugin until patched
• Review web server and WAF logs for requests containing suspicious wppa-cat parameter values with script-like content (e.g., <script>, onerror=, javascript:)

Detection Opportunities

• Monitor access logs for gallery URLs with anomalous or encoded content in the wppa-cat query parameter
• Watch for unexpected administrator account creation or content edits following reports of suspicious links shared with site visitors

Defence-in-Depth

• Deploy a Content Security Policy (CSP) to limit the impact of any successful script injection
• Keep all WordPress plugins on a regular patch cadence; subscribe to a vulnerability feed (e.g., WPScan, Patchstack) for early warning on plugins in active use
• Apply the principle of least privilege to WordPress admin and editor accounts to reduce the blast radius of session-based attacks

Discovery & Disclosure

CVE-2026-110981 was reserved on October 15, 2026 and published on October 18, 2026, with WPScan acting as the CNA. As of publication, no public proof-of-concept exploit has been observed and the flaw is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Given the low complexity of exploitation and lack of required authentication, site owners should not wait for in-the-wild activity before patching.

References

• NVD — CVE-2026-110981
• Strix — CVE-2026-110981: WP Photo Album Plus XSS
• VulDB — CVE-2026-110981