Atomic Edge analysis of CVE-2026-57675: This vulnerability is an unauthenticated stored cross-site scripting (XSS) in the WP Photo Album Plus plugin for WordPress, affecting versions up to and including 9.2.02.004. The flaw resides in the input sanitization logic within the wppa-input.php file, specifically in a switch case handling ‘tags’ and ‘cat’ parameters. An attacker can inject arbitrary HTML and JavaScript that persists in the application and executes when a victim views the compromised page. The CVSS score is 7.2, reflecting the high impact and lack of required authentication.
Root Cause: The root cause is insufficient output escaping and sanitization of user-controlled input. In wppa-input.php, the vulnerable code is at line 329, inside a switch statement case for ‘tags’ and ‘cat’. The original code returns the value from wppa_sanitize_tags( sanitize_text_field( wp_unslash( $_REQUEST[$key] ) ), ‘,;’ ) after trimming. The wppa_sanitize_tags function (not shown in the diff) likely allows certain HTML tags by design, but the application does not escape the output before rendering it in the browser. The sanitize_text_field function strips some dangerous characters but does not remove all XSS vectors, especially when combined with allowed HTML tags in wppa_sanitize_tags. The parameter $key is derived from user-supplied input, and the vulnerability is triggered when an unauthenticated user submits a request to an endpoint that processes ‘tags’ or ‘cat’ parameters without proper authorization checks.
Exploitation: An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to a WP Photo Album Plus endpoint that accepts and processes the ‘tags’ or ‘cat’ parameters. The attack vector is likely through a public-facing AJAX action or form handler that stores these parameters into the database without requiring authentication. The attacker injects a payload such as alert(‘XSS’) or an event handler like . Because the input is stored and later rendered without proper escaping, any user (including admins) who views the affected page will execute the malicious script. The specific endpoints may include admin-ajax.php with an action that handles tags or direct HTTP requests to plugin-specific public endpoints.
Patch Analysis: The patch, shown in the diff, adds a str_replace function call to remove single quotes (‘) from the processed input. The line changes from return isset( $_REQUEST[$key] ) ? trim( wppa_sanitize_tags( sanitize_text_field( wp_unslash( $_REQUEST[$key] ) ), ‘,;’ ) ) : $default; to return isset( $_REQUEST[$key] ) ? str_replace( “‘”, “”, trim( wppa_sanitize_tags( sanitize_text_field( wp_unslash( $_REQUEST[$key] ) ), ‘,;’ ) ) ) : $default;. This change strips single quotation marks, which breaks many common XSS payloads that rely on event handlers with single-quoted attribute values, but it does not address the fundamental lack of output escaping. The patch is a partial fix and may not prevent all XSS variants (e.g., those using double quotes or backticks). A more robust fix would involve escaping the output with esc_html() or wp_kses_post() before rendering.
Impact: Successful exploitation allows an unauthenticated attacker to inject arbitrary web scripts that execute in the context of any user who accesses the injected page. This can lead to session hijacking, credential theft, defacement, redirection to malicious websites, and further compromise of the WordPress installation. Since the XSS is stored, the attack can propagate to all visitors, including administrators, potentially enabling privilege escalation or full site takeover if admin cookies are stolen.
