CVE-2026-18579 | opajaap WP Photo Album Plus Plugin up to 9.2.08.003 on WordPress wp_ajax_nopriv_wppa Endpoint getshortcodedrenderedfenodelay HTTP_X_FORWARDED_FOR cross site scripting

A vulnerability was found in opajaap WP Photo Album Plus Plugin up to 9.2.08.003 on WordPress. It has been classified as problematic. Affected by this issue is the function getshortcodedrenderedfenodelay of the component wp_ajax_nopriv_wppa Endpoint. This manipulation of the argument HTTP_X_FORWARDED_FOR causes cross site scripting.

This vulnerability is tracked as CVE-2026-18579. The attack is possible to be carried out remotely. No exploit exists.VulDB Recent EntriesRead More