WP Photo Album Plus <= 8.0.9 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated

Published
2022-01-01

The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.

CVE

https://www.cve.org/CVERecord?id=CVE-2021-25115

CVSS

Score:6.1

Severity:Medium

Version: 8.0.9

There is a patch available in v8.0.10 and we strongly recommend you update to this version as soon as possible.