Stored Cross-Site Scripting in WP Photo Album Plus Plugin by WordPress

CVE-2026-18579

What is CVE-2026-18579?

The WP Photo Album Plus plugin for WordPress has a vulnerability that allows for stored cross-site scripting through the 'HTTP_X_FORWARDED_FOR' parameter. This issue arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to insert malicious web scripts into pages. When users access the infected pages, these scripts can execute, potentially compromising their data and privacy. Unsecured nonce verification can trigger logging of the attacker's input, making this flaw accessible to anyone through specific WordPress AJAX endpoints.

References