CVE-2026-110983

MediumCVSS 4.3/10Last modified Oct 29, 2026

Description

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	WP Photo Album Plus	< 9.3.04.004

References

https://wpscan.com/vulnerability/3375c88c-7f61-47d6-b9e0-76ad86ce1800/

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1109859.1A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its impl CVE-2026-1109926.5A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository p CVE-2026-11107.8A flaw has been found in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. This affects the function rtsp_parse_method. This ma CVE-2026-111009.6Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spec CVE-2026-1110007.1A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain CVE-2026-111016.5Uninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craft CVE-2026-111028.8Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary cod CVE-2026-1110217.1The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting CVE-2026-1110247.1A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a View CVE-2026-1110276.8The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and CVE-2026-111037.8Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level pr CVE-2026-1110314.7The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthen