CVE-2026-14922 in WP Photo Album Plus Plugin
Summary
by MITRE • 07/31/2026
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `&lt;img src=... onload=...&gt;`) passes the write filters as harmless entity text and is stored one decode-level down (`<img ... onload=...>`).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The WP Photo Album Plus plugin presents a critical stored cross-site scripting vulnerability that affects all versions up to and including 9.2.03.001, representing a significant security risk for WordPress installations. This vulnerability stems from a flawed sanitization process within the photo-comment handling pipeline, specifically in the `wppa_do_comment()` function which processes user-submitted comments. The flaw operates through a sophisticated decode-after-sanitize mechanism that allows malicious payloads to bypass security filters by exploiting the order and nature of HTML entity decoding operations.
The technical implementation of this vulnerability occurs when the plugin applies two sequential sanitization functions during comment processing. First, `wppa_filter_html()` is called which utilizes WordPress's built-in `wp_kses()` function to sanitize HTML content, followed immediately by `wp_strip_all_tags()` from `wppa-functions.php` at lines 2623-2624. This dual-filter approach creates a dangerous gap in security because `wp_strip_all_tags()` only removes actual HTML tags rather than HTML entities or encoded content. When an attacker submits a double-encoded payload such as `&lt;img src=... onload=...&gt;`, the first sanitization step allows the content to pass through as harmless text since the entity encoding prevents immediate recognition of malicious intent. However, when the content is later decoded one level during storage or display processing, it transforms into a legitimate-looking but dangerous HTML element like `<img src=... onload=...>`, which then executes in the browser context of any user viewing the affected comment.
This vulnerability directly maps to CWE-79 (Cross-Site Scripting) and specifically manifests as a stored XSS condition that can persist indefinitely within the plugin's comment system. The operational impact extends beyond simple script execution, as it provides attackers with potential access to user sessions, data exfiltration capabilities, and the ability to perform actions on behalf of authenticated users. The attack vector requires minimal technical expertise since it leverages the existing comment submission functionality that typically lacks robust security controls for user-generated content. This makes it particularly dangerous in environments where users may have varying levels of privilege or where administrators do not closely monitor comment submissions.
The exploitation of this vulnerability creates a persistent threat that can affect all users who view affected comments, making it a high-severity issue that demands immediate remediation. Organizations utilizing WP Photo Album Plus should prioritize updating to versions that address this specific sanitization flaw, as the vulnerability allows for long-term persistence of malicious code within the plugin's comment storage system. The double-encoding technique used in this attack demonstrates a sophisticated understanding of how HTML entity decoding works in web applications and highlights the importance of applying security measures at multiple layers of processing. The vulnerability essentially creates a backdoor for attackers to execute arbitrary JavaScript code within legitimate user sessions, potentially leading to complete compromise of affected WordPress installations through session hijacking or further exploitation of other system vulnerabilities.