CVE-2026-110981: CWE-79 Cross-Site Scripting (XSS) in WP Photo Album Plus

CVE-2026-110981 is a reflected Cross-Site Scripting (CWE-79) vulnerability in WP Photo Album Plus versions prior to 9.2.11.002. The vulnerability occurs due to improper escaping of a category navigation value before it is embedded into a JavaScript event handler on gallery breadcrumb links. An unauthenticated attacker can craft a malicious gallery link that, when visited and interacted with by a user (clicking the breadcrumb), executes arbitrary JavaScript in the victim's browser. This can affect any user, including administrators, potentially leading to session hijacking or other script-based attacks.

The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of users visiting a maliciously crafted gallery link and interacting with the breadcrumb navigation. This can lead to theft of credentials, session tokens, or other sensitive information accessible to the browser, and can compromise administrative accounts if administrators are tricked into clicking the breadcrumb.

A fixed version of WP Photo Album Plus is available at version 9.2.11.002. Users should upgrade to version 9.2.11.002 or later to remediate this vulnerability. No additional mitigation steps are indicated.