WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in WP Photo Album Plus

This plugin is more than just a photo album plugin, it is a complete, highly customizable multimedia cms and display system.

30Reported vulnerabilities
10Highest CVSS score
9.2.10.004Latest version
10,000+Active installs

What to do now

Update WP Photo Album Plus to 9.2.07.002 or later. 30 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2008-0939 Critical 9.8 4.3% 1.0 and earlier 1.1 February 25, 2008
CVE-2021-25115 Medium 6.4 0.7% Before 8.0.10.006 8.0.10.006 February 14, 2022
CVE-2024-31377 Critical 10 0.5% 8.7.01.001 and earlier 8.7.01.002 May 7, 2024
CVE-2024-31286 Critical 9.9 0.9% 8.6.03.004 and earlier 8.6.03.005 April 5, 2024
CVE-2026-18048 Critical 9.1 0.2% 9.2.07.1 and earlier 9.2.07.002 August 10, 2026
CVE-2015-3647 Medium 4.3 2.4% 6.1.2 and earlier 6.1.3 May 21, 2015
CVE-2024-10958 High 7.3 1.6% Before 8.9.01.001 8.9.01.001 November 10, 2024
CVE-2026-54829 High 7.5 0.3% 9.1.13.005 and earlier 9.2.01.001 June 17, 2026
CVE-2026-6379 High 7.5 0.5% Before 9.1.11.001 9.1.11.001 June 11, 2026
CVE-2026-39511 High 7.5 0.3% 9.1.08.001 and earlier 9.1.08.002 April 13, 2026
CVE-2026-57675 High 7.2 0.3% 9.2.02.004 and earlier 9.2.03.001 June 30, 2026
CVE-2024-4037 High 7.3 0.5% Before 8.7.00.004 8.7.00.004 May 24, 2024
CVE-2025-14835 High 7.1 0.3% 0 to 9.1.05.008 (inclusive) 9.1.05.009 January 7, 2026
CVE-2013-3254 Medium 6.1 1.6% Before 5.0.3 5.0.3 May 6, 2013
CVE-2026-10095 Medium 6.4 0.4% 0 to 9.1.13.005 (inclusive) 9.2.01.001 July 1, 2026
CVE-2024-38713 Medium 6.4 0.3% 8.8.02.002 and earlier 8.8.02.003 July 11, 2024
CVE-2026-14922 Medium 6.4 0.1% Before 9.2.04.003 9.2.04.003 August 13, 2026
WF-fdbb60e5-4d67-4deb-94e0-788c1fb0e42f Medium 6.4 — 5.4.7 and earlier 5.4.8 September 17, 2014
CVE-2026-17013 Medium 6.1 0.2% 9.2.07.1 and earlier 9.2.07.002 August 10, 2026
CVE-2024-9951 Medium 6.1 0.3% 8.8.05.003 and earlier 8.8.07.004 October 16, 2024
CVE-2024-37416 Medium 6.1 0.3% 8.8.00.002 and earlier 8.8.00.003 June 28, 2024
CVE-2023-49813 Medium 6.1 0.4% 8.5.02.005 and earlier 8.6.01.005 December 5, 2023
CVE-2014-8814 Medium 6.1 — 5.4.17 and earlier 5.4.18 November 6, 2014
CVE-2023-49812 Medium 5.3 0.5% 8.5.02.005 and earlier 8.6.01.005 December 5, 2023
CVE-2026-18049 Medium 5.3 0.3% Before 9.2.07.002 9.2.07.002 August 14, 2026
CVE-2026-17014 Medium 5.3 0.2% 9.2.07.1 and earlier 9.2.07.002 August 3, 2026
CVE-2025-8726 Medium 5.4 0.2% 0 to 9.0.11.006 (inclusive) 9.0.11.007 October 4, 2025
CVE-2023-49774 Medium 5.3 0.3% 8.5.02.005 and earlier 8.6.01.005 December 5, 2023
CVE-2026-15344 Medium 4.9 0.3% 0 to 9.2.04.002 (inclusive) 9.2.04.003 July 29, 2026
CVE-2026-18962 Medium 4.3 0.2% 9.2.09.1 and earlier 9.2.09.002 August 10, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.