Reflected Cross-Site Scripting in WP Photo Album Plus Plugin for WordPress

CVE-2025-14835

What is CVE-2025-14835?

The WP Photo Album Plus plugin for WordPress exhibits a critical security flaw due to inadequate input sanitization and output escaping in its ‘shortcode’ parameter. This vulnerability enables unauthenticated attackers to craft malicious web scripts that can be injected onto pages. If a user is fooled into clicking on a compromised link, these scripts could execute within their browser, posing a significant risk to user data and site integrity. It's crucial for site administrators using this plugin to be aware of this issue and take necessary actions to safeguard their systems.

References