The WP Photo Album Plus plugin suffers from a stored Cross-Site Scripting vulnerability in all versions up to and including 9.2.03.001. The issue stems from the comment sanitization workflow in the function `wppa_do_comment()`, which first sanitizes input using `wppa_filter_html()` (based on wp_kses) and then strips tags with `wp_strip_all_tags()`. However, `wp_strip_all_tags()` only removes actual HTML tags and does not decode HTML entities before doing so. An attacker can submit a double HTML-entity-encoded payload (e.g., `<img src=... onload=...>`), which passes the sanitization as harmless text but is stored one decode level down as executable HTML (`<img ... onload=...>`). When rendered, this results in stored XSS execution. The vulnerability is tracked as CVE-2026-14922 with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No known exploits are reported in the wild and no patch information is provided.

Successful exploitation allows an attacker to inject stored malicious scripts into photo comments, which execute in the context of users viewing those comments. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no reported impact on availability. The vulnerability requires user interaction (UI:R) and can be exploited remotely without privileges (AV:N/PR:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the photo comment feature to mitigate risk. Avoid allowing untrusted users to post comments or apply additional filtering on input to prevent double-encoded payloads. Monitor vendor channels for updates and apply official patches once released.