Threats tagged 'ghsa-fgvj-388g-xj2c'

A Cross-Site Scripting (XSS) vulnerability exists in the WP Photo Album Plus WordPress plugin before version 9.2.11.002. The flaw arises because the plugin does not properly escape a category navigation value before reflecting it into a JavaScript event handler on gallery breadcrumb links. This allows unauthenticated attackers to inject arbitrary scripts that execute in the browser of anyone who clicks the crafted breadcrumb link, including logged-in administrators.