This vulnerability, identified as CWE-79, exists in WP Photo Album Plus versions up to 9.3.02.003. It allows subscriber-level users to perform cross-site scripting attacks due to improper input neutralization during web page generation. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges at the subscriber level, user interaction, and a scope change with limited confidentiality, integrity, and availability impacts.

An attacker with subscriber privileges can exploit this vulnerability to execute arbitrary scripts in the context of the affected web application. This can lead to partial compromise of confidentiality, integrity, and availability of the application data or user sessions. However, the impact is limited by the requirement of subscriber-level privileges and user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting subscriber input or applying web application firewall rules to detect and block XSS payloads.