Unrated severityNVD Advisory· Published May 10, 2013· Updated Jun 16, 2026
CVE-2013-3254
CVE-2013-3254
Description
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppa_manage_comments edit action.
Affected products
4cpe:2.3:a:wppa.opajaap:wp-photo-album-plus:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:wppa.opajaap:wp-photo-album-plus:*:*:*:*:*:*:*:*range: <=5.0.2
- cpe:2.3:a:wppa.opajaap:wp-photo-album-plus:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:wppa.opajaap:wp-photo-album-plus:5.0.1:*:*:*:*:*:*:*
- Range: <5.0.3
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.