The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtext'…

CVE-2026-10095 is a stored cross-site scripting flaw in the WP Photo Album Plus plugin for WordPress. The subtext parameter is not sanitized on input nor escaped on output, letting any user with post/album creation privileges (typically Contributor+) inject arbitrary HTML and JavaScript that later executes in the browser of any visitor — including administrators — who views the affected album. Affected versions are all releases up to and including the last unpatched build noted in the advisory; the vendor pushed a fix in the subsequent release.

The vendor MEDIUM (6.4) rating is roughly right. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L) correctly captures scope-change into the admin's browser session and low authentication requirement, but does not credit the niche install base of this plugin, the contributor role gate, and the absence of any known in-the-wild activity. Net-net: the score is defensible; no reason to upgrade, and downgrading past MEDIUM would ignore the very real admin-account-takeover path when the stars align.

Why this verdict

• Auth-gated (PR:L): the attacker needs an existing Contributor+ account; on enterprise WordPress with registration disabled this closes off untargeted mass exploitation.
• Victim-interaction dependency: the payload only fires when an admin (or other privileged user) actually browses the poisoned album — a probabilistic, not deterministic, step.
• Role multiplier: content plugin on a marketing/blog WordPress — chain ends in admin takeover of that WordPress instance, blast radius limited to one CMS tenant. No fleet, identity, or supply-chain pivot.
• Role multiplier: agency/multi-tenant WordPress host — chain still terminates at a single site's admin; cross-tenant escape would require a separate WP-core or hoster-plane bug.
• Niche install base: WP Photo Album Plus is not among the top 100 WordPress plugins; the exposed population is small relative to Elementor-class CVEs.
• No KEV, no known campaigns, no exploit kit inclusion as of assessment date.

Why not higher?

HIGH would require either a larger install base with automatable mass exploitation, an unauthenticated variant, or evidence of active exploitation. None are present: PR:L plus victim-interaction plus a niche plugin puts this squarely in MEDIUM. Stored XSS in a low-market-share plugin does not clear the HIGH bar without in-the-wild proof.

Why not lower?

LOW would ignore the very real admin-takeover terminus of this chain when it does fire — full CMS compromise on the affected site is not a nuisance-tier outcome. The scope-change into a privileged browser session is why CVSS correctly rates this above LOW, and we agree.

1. Update WP Photo Album Plus to the patched release — The definitive fix. Schedule within the noisgate remediation SLA of 365 days for MEDIUM, but treat any site with open registration as a 30-day priority. Use WP-CLI: wp plugin update wp-photo-album-plus across the fleet.
2. Disable open user registration where not required — Kills step 1 of the chain. Settings → General → Membership unchecked, or set users_can_register to 0 via WP-CLI on every managed instance. No mitigation SLA at MEDIUM, but this is a permanent hardening win — do it now.
3. Enforce a strict CSP on /wp-admin/ — A Content-Security-Policy: script-src 'self'; object-src 'none' header served on admin pages blunts the exfil/RCE payload even if injection succeeds. Deploy via a security header plugin (e.g., HTTP Headers) or WAF rule.
4. Enable a WAF signature set for XSS payloads on POST bodies to admin-ajax.php and REST endpoints — Wordfence Premium, Sucuri, or Cloudflare Managed Rules will filter the obvious <script>/onerror patterns targeting the subtext parameter until you patch.
5. Restrict Contributor role from creating albums via a role-editor plugin — If you cannot patch immediately, remove the Contributor's edit_posts linkage to the plugin's album CPT. Members / User Role Editor plugins let you scope this precisely.

Run on any Linux host that has WP-CLI installed and shell access to the WordPress webroot. Invoke as: ./check-cve-2026-10095.sh /var/www/html. Requires read access to the WordPress installation directory; no root needed if the invoking user can read wp-content/plugins/.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-10095 — WP Photo Album Plus stored XSS via `subtext`
# Usage: ./check-cve-2026-10095.sh <wordpress_root>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u
WP_ROOT="${1:-}"
PLUGIN_SLUG="wp-photo-album-plus"
# NOTE: update FIXED_VERSION to the vendor-patched release once confirmed
FIXED_VERSION="8.9.99"

if [[ -z "$WP_ROOT" || ! -d "$WP_ROOT" ]]; then
  echo "UNKNOWN: pass the WordPress root as arg 1" >&2
  exit 2
fi

PLUGIN_DIR="$WP_ROOT/wp-content/plugins/$PLUGIN_SLUG"
if [[ ! -d "$PLUGIN_DIR" ]]; then
  echo "PATCHED: $PLUGIN_SLUG not installed at $PLUGIN_DIR"
  exit 0
fi

HEADER_FILE="$(grep -lE '^\s*\*?\s*Plugin Name:' "$PLUGIN_DIR"/*.php 2>/dev/null | head -n1 || true)"
if [[ -z "$HEADER_FILE" ]]; then
  echo "UNKNOWN: could not locate plugin header in $PLUGIN_DIR"
  exit 2
fi

INSTALLED="$(grep -iE '^\s*\*?\s*Version:' "$HEADER_FILE" | head -n1 | sed -E 's/.*Version:\s*//; s/[[:space:]]+$//')"
if [[ -z "$INSTALLED" ]]; then
  echo "UNKNOWN: could not parse installed version"
  exit 2
fi

# semantic version compare: lowest first
LOWEST="$(printf '%s\n%s\n' "$INSTALLED" "$FIXED_VERSION" | sort -V | head -n1)"
if [[ "$INSTALLED" == "$FIXED_VERSION" || "$LOWEST" == "$FIXED_VERSION" ]]; then
  echo "PATCHED: $PLUGIN_SLUG $INSTALLED >= $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE: $PLUGIN_SLUG $INSTALLED < $FIXED_VERSION (CVE-2026-10095)"
  exit 1
fi

Sources

1. NVD entry (placeholder — check post-publication)
2. Wordfence Intelligence CVE feed
3. Patchstack vulnerability database
4. WP Photo Album Plus on wordpress.org
5. CWE-79: Cross-Site Scripting
6. CISA KEV catalog
7. FIRST EPSS
8. OWASP XSS Prevention Cheat Sheet