WP Photo Album Plus, f7b99fd4f8e9b751948a0b385e19119256d8ce92

CVE, Research URL: f7b99fd4f8e9b751948a0b385e19119256d8ce92
Home page URL: Security reports for WP Photo Album Plus
Application: WP Photo Album Plus
Published on: Sep 17, 2014
Research Description: WP Photo Album Plus [wp-photo-album-plus] >= 5.4.5 - <= 5.4.8 WP Photo Album Plus <= 5.4.7 - Stored Cross-Site Scripting The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zip' parameter in versions up to, and including, 5.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min 5.4.5, max 5.4.8.
Status: vulnerable