The WP Photo Album Plus plugin for WordPress contains a Cross-Site Scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the wppa_user_upload function does not adequately sanitize or escape user-supplied input in photo album descriptions. Authenticated attackers with at least Subscriber privileges can exploit this to inject arbitrary JavaScript that executes in the context of other users' browsers, potentially leading to session hijacking or other client-side impacts. The vulnerability affects all versions up to and including 9.0.11.006. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, and requirement for user interaction.

An attacker with Subscriber-level access or higher can inject malicious scripts into photo album descriptions, which execute in the browsers of other users viewing those descriptions. This can lead to limited confidentiality and integrity impacts on affected users, such as theft of session tokens or manipulation of displayed content. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — no official fix or patch information is currently available. Users should monitor the vendor's advisory channels for updates. In the meantime, restricting user permissions to trusted users and limiting who can upload or edit photo album descriptions may reduce risk. Avoid granting Subscriber or higher privileges to untrusted users. Once a patch is released, apply it promptly.