What is GHSA-5vf5-jrp9-rv6g?

GHSA-5vf5-jrp9-rv6g is a security advisory published by GitHub Security Advisories with Medium severity. The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a...

Which CVE IDs does GHSA-5vf5-jrp9-rv6g cover?

GHSA-5vf5-jrp9-rv6g covers the following CVE IDs: CVE-2026-110983. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5vf5-jrp9-rv6g?

GHSA-5vf5-jrp9-rv6g has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-5vf5-jrp9-rv6gMediumCVSS 4.3

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a...

Vendor

GitHub Security Advisories

Published

October 29, 2026

Last Modified

October 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-110983 →

📋 Description

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-110983
https://wpscan.com/vulnerability/3375c88c-7f61-47d6-b9e0-76ad86ce1800
https://github.com/advisories/GHSA-5vf5-jrp9-rv6g