WP Photo Album Plus Stored XSS in Gallery Breadcrumbs

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is a reflected cross-site scripting (XSS) flaw in the WP Photo Album Plus WordPress plugin that exploits improper output encoding in gallery breadcrumb navigation. An attacker can craft a malicious gallery link containing JavaScript payloads in category parameters, which execute in the browser when a user clicks the breadcrumb link. This affects any WordPress site running the vulnerable plugin version, with particular risk to administrators and authenticated users who may have elevated privileges. The attack requires user interaction but is delivered unauthenticated, making it a practical vector for widespread compromise, data theft, session hijacking, or malware distribution.

Casky's 323 mapped skills detect this attack pattern through MITRE ATT&CK technique TA0001 (Initial Access) and TA0043 (Reconnaissance), identifying the indicators of reflected XSS exploitation. Practitioners using Casky would observe detections for improper input validation in web parameters, JavaScript execution contexts lacking proper Content Security Policy headers, and DOM-based payload reflection in event handlers. The platform's extended reasoning capabilities help security teams trace the attack chain: malicious link distribution → parameter injection → JavaScript execution in victim browsers → session theft or admin impersonation. Real-world findings would highlight HTTP requests containing JavaScript in category parameters, absence of HTML entity encoding in breadcrumb rendering, and browser-side payload execution patterns that deviate from normal gallery navigation behavior.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-110981.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-110981

Casky has 323 skills that investigate the attack patterns behind CVE-2026-110981. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn