CVE-2026-54829 - WordPress WP Photo Album Plus plugin <= 9.1.13.005

Back Back to CVE browser

HIGH

WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability

Published Jun 25, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.32%

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection.

This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.

Affected products

Vendor Jacob N. Breetvelt Product WP Photo Album Plus Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=9.1.13.005

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jacob N. Breetvelt

WP Photo Album Plus

unaffected

Version	Status	Constraints
-	affected	<=9.1.13.005

Remediation

Vendor solution

Update the WordPress WP Photo Album Plus Plugin to the latest available version (at least 9.2.01.001).

Weaknesses (1)

CWE-89

SQL Injection

References (1)

https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-1-13-005-sql-injection-vulnerability?_s_id=cve
vdb-entry

Link	Providers	Tags
https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-1-13-005-sql-injection-vulnerability?_s_id=cve		vdb-entry