The WP Photo Album Plus plugin for WordPress is affected by a stored cross-site scripting vulnerability (CWE-79) in all versions up to and including 9.1.13.005. The vulnerability exists due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'subtext' parameter. Authenticated attackers with contributor-level privileges or higher can embed malicious scripts via the photo shortcode in posts submitted for review. These scripts execute whenever an administrator or any user views the injected page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with contributor-level access can inject persistent malicious scripts into posts via the 'subtext' parameter, which execute in the context of users viewing those posts, including administrators. This can lead to unauthorized actions performed on behalf of users, data theft, or session compromise. The vulnerability does not impact availability but affects confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and review posts carefully before publishing. Consider disabling or limiting the use of the photo shortcode or the vulnerable parameter if possible.