WP Photo Album Plus, CVE-2013-3254

CVE, Research URL: CVE-2013-3254
Home page URL: Security reports for WP Photo Album Plus
Application: WP Photo Album Plus
Published on: May 10, 2013
Research Description: Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppa_manage_comments edit action.
Affected versions: Min 5.4.5, max 4.2.0.
Status: vulnerable