https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T12:56:19.022486+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-351387 EUVD-2026-351387 2026-10-09T12:56:19.024716+00:00 EUVD-2026-351387 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18962 fkie_cve-2026-18962 2026-10-09T12:56:19.024747+00:00

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.

 https://cve.radiocsirt.org/vuln/ghsa-q3rf-7cjg-vf9x GHSA-q3rf-7cjg-vf9x 2026-10-09T12:56:19.024780+00:00

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the administrator. Exploitation requires the WP Photo Album Plus WordPress plugin before 9.2.09.002's front-end user upload feature to be enabled, which is not the default.