CVE-2026-18579 describes a stored cross-site scripting vulnerability in the WP Photo Album Plus WordPress plugin. The flaw exists in all versions up to and including 9.2.08.003 due to insufficient sanitization and escaping of the HTTP_X_FORWARDED_FOR parameter. An attacker can cause the plugin's logging function to record malicious input by triggering a nonce failure in the getshortcodedrenderedfenodelay action via the wp_ajax_nopriv_wppa endpoint. This allows injection of arbitrary web scripts that execute in the context of users visiting the injected pages.

The vulnerability enables unauthenticated attackers to inject and execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS score of 7.2 (high) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently confirmed. Users should monitor the vendor advisory for updates. Until a fix is available, consider disabling or restricting access to the vulnerable plugin or the affected AJAX endpoint to reduce exposure.