CVE-2026-119477 is a stored cross-site scripting (XSS) vulnerability in WP Photo Album Plus plugin for WordPress. It affects versions up to and including 9.3.05.003. The flaw involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in users' browsers. This vulnerability has a high severity rating with a CVSS score of 7.1.