The WP Photo Album Plus WordPress plugin suffers from a stored Cross-Site Scripting vulnerability (CWE-79) in all versions up to 9.1.13.005. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'subtext' parameter. Authenticated attackers with contributor-level privileges or higher can embed malicious scripts via the [photo] shortcode in posts submitted for review. These scripts execute when an administrator or any user views the injected post, potentially leading to session hijacking or other script-based attacks. No official patch or remediation level has been published as of the data provided.

An attacker with contributor-level access or above can inject persistent malicious scripts that execute in the context of other users viewing the affected pages. This can lead to unauthorized actions performed on behalf of users, data theft, or session hijacking. The vulnerability does not impact availability but compromises confidentiality and integrity. The CVSS 3.1 base score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to post submissions containing the [photo] shortcode. Consider applying manual input sanitization or output escaping if feasible. Avoid viewing untrusted posts containing the vulnerable parameter.