The WP Photo Album Plus plugin for WordPress contains a reflected XSS vulnerability due to improper neutralization of input in the 'wppa-tab' parameter. This allows unauthenticated attackers to inject and execute arbitrary web scripts by convincing users to interact with malicious links. The issue affects all plugin versions up to and including 8.8.05.003. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser session, potentially compromising user data confidentiality and integrity. The vulnerability does not impact system availability. Since it is a reflected XSS, exploitation requires user interaction (clicking a malicious link). No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links involving the 'wppa-tab' parameter and consider disabling or limiting use of the WP Photo Album Plus plugin. Monitoring vendor channels for updates is recommended.