CVE-2026-124260 is a reflected Cross-site Scripting (XSS) vulnerability in the WP Photo Album Plus plugin for WordPress. It affects versions up to and including 9.3.06.001. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the victim's browser.