CVE-2026-14922 is a stored Cross-Site Scripting vulnerability in WP Photo Album Plus affecting all versions up to 9.2.03.001. The flaw exists due to a decode-after-sanitize (double-encoding) issue in the comment processing pipeline. Specifically, the function `wppa_do_comment()` sanitizes input using `wppa_filter_html()` (which uses wp_kses) and then `wp_strip_all_tags()`. However, `wp_strip_all_tags()` only removes actual HTML tags, allowing a double HTML-entity-encoded payload (e.g., `<img src=... onload=...>`) to pass through as harmless text. When stored, this payload is decoded once, resulting in executable HTML/JavaScript code being stored and later rendered, enabling XSS attacks.

An attacker can inject malicious scripts into photo comments that are stored and later executed in the browsers of users viewing those comments. This can lead to session hijacking, defacement, or other client-side attacks. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Until a patch is available, users should consider disabling or restricting the comment functionality or applying additional input validation/sanitization controls if possible.