CVE-2026-110981: WP Photo Album Plus 0 to before 9.2.11.002

Affected technology

WP Photo Album Plus · 0 to before 9.2.11.002
Vendor not specified by the source

Description’s affected range: before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.