CVE-2026-14922

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `<img src=... onload=...>`) passes the write filters as harmless entity text and is stored one decode-level down (`<img ... onload=...>`).

• CWE-79

• https://wpscan.com/vulnerability/ca9f99eb-221a-417e-b18f-0a8b8b513f2e/

Published

Jul 31, 2026

Last Modified

Jul 31, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-14906Pages with malicious titles could potentially allow saved PD…5.3
• CVE-2026-1491IBM Verify Identity Access Container 11.0 through 11.0.2 and…5.3
• CVE-2026-14919The ShopMonitor.io WordPress plugin before 1.2.0 does not p…9.8
• CVE-2026-1492The User Registration & Membership – Custom Registration For…9.8
• CVE-2026-14920## Summary8.2
• CVE-2026-14921The Ultimate Addons for WPBakery Page Builder WordPress plug…6.1
• CVE-2026-14923The Sync Post With Other Site WordPress plugin before 1.9.3 …6.5
• CVE-2026-14924The Tablesome Table WordPress plugin before 1.1.31 does not…7.5
• CVE-2026-14925The Import WP WordPress plugin before 2.14.23 does not perf…
• CVE-2026-14926The FluentCart A New Era of eCommerce WordPress plugin befo…4.2
• CVE-2026-14927The FluentCart A New Era of eCommerce WordPress plugin befo…3.7
• CVE-2026-14928The JS Help Desk WordPress plugin before 3.1.4 does not per…6.5