WordPress CVEs

Description

Multiple cross-site scripting (XSS) vulnerabilities in wppa-ajax-front.php in the WP Photo Album Plus (aka WPPA) plugin before 6.1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) comemail or (2) comname parameter in a wppa do-comment action.

Affected WordPress components

• WP Photo Album Plus Plugin · wp-photo-album-plus
  Confirmed match Active
  Versions not specified; Up to and including 6.1.2
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wppa.opajaap wp-photo-album-plus — Up to and including 6.1.2

References

• packetstormsecurity.com http://packetstormsecurity.com/files/131976/WordPress-WP-Photo-Album-Plus-6.1.2-Cross-Site-Scripting.html Exploit
• www.securityfocus.com http://www.securityfocus.com/archive/1/535575/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/bid/74741 Exploit
• wordpress.org https://wordpress.org/plugins/wp-photo-album-plus/changelog/ Patch, Vendor Advisory
• www.htbridge.com https://www.htbridge.com/advisory/HTB23257 Exploit
• nvd.nist.gov Official NVD record