WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
An unauthenticated stored cross-site scripting vulnerability in the WP Photo Album Plus WordPress plugin allows remote attackers to inject arbitrary web scripts via the REQUEST_URI session history mechanism, executing whenever users view affected pages.