Skip to content
PluginCanary

WP Photo Album Plus

by Jacob N. Breetvelt · 10,000+ active installs · Checked 3 Nov 2026
Healthy12 Warnings

Healthy: vulnerability published 16 Oct 2026, fixed in 9.2.11.002.

81/ 100 Canary Score
Sub-scores for WP Photo Album Plus
Ownership100
Maintenance100
Security60
Support71
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 16 Oct 2026, fixed in 9.2.11.002. Update to version 9.2.11.002 or later.16 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 15 Oct 2026, fixed in 9.3.02.003. Update to version 9.3.02.003 or later.15 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 9.3.03.003. Update to version 9.3.03.003 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Sep 2026, fixed in 9.3.03.002. Update to version 9.3.03.002 or later.30 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 23 Sep 2026, fixed in 9.3.02.003. Update to version 9.3.02.003 or later.23 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 18 Sep 2026, fixed in 9.3.01.003. Update to version 9.3.01.003 or later.18 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 10 Sep 2026, fixed in 9.2.10.001. Update to version 9.2.10.001 or later.10 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 14 Aug 2026, fixed in 9.2.07.002. Update to version 9.2.07.002 or later.14 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 13 Aug 2026, fixed in 9.2.04.003. Update to version 9.2.04.003 or later.13 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 10 Aug 2026, fixed in 9.2.07.002. Update to version 9.2.07.002 or later.10 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 10 Aug 2026, fixed in 9.2.09.002. Update to version 9.2.09.002 or later.10 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 10 Aug 2026, fixed in 9.2.07.002. Update to version 9.2.07.002 or later.10 Aug 2026Evidence
  • InfoSEC-322 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
opajaap29 Aug 2021 to 30 Oct 2026, 2000 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
8 days ago
Releases, 24 months
289
Tested up to
7.1 current
Requires PHP
5.5 supported 8.2+
Releases per quarter for WP Photo Album Plus
Q1 20240
Q2 202430
Q3 202436
Q4 20247
Q1 20254
Q2 20254
Q3 20255
Q4 20257
Q1 20263
Q2 2026219
Q3 202634
Q4 20268

Last release 27 Oct 2026. Tested with WordPress 7.1 (current).

Support

71% of 14 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
16 Oct 2026Photo Album Plus <= 9.2.11.1 - Reflected Cross-Site Scripting6.1<= 9.2.11.19.2.11.0020
15 Oct 2026WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action8.8<= 9.3.02.0029.3.02.0030
9 Oct 2026WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History7.2<= 9.3.03.0029.3.03.0030
30 Sep 2026WP Photo Album Plus <= 9.3.02.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 9.3.02.0039.3.03.0020
23 Sep 2026WP Photo Album Plus <= 9.3.02.002 - Unauthenticated Stored Cross-Site Scripting7.2<= 9.3.02.0029.3.02.0030
18 Sep 2026WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection7.5<= 9.2.09.0029.3.01.0030
10 Sep 2026WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting7.2<= 9.2.08.0039.2.10.0010
14 Aug 2026WP Photo Album Plus < 9.2.07.002 - Missing Authorization5.3< 9.2.07.0029.2.07.0020
13 Aug 2026WP Photo Album Plus < 9.2.04.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4< 9.2.04.0039.2.04.0030
10 Aug 2026Photo Album Plus <= 9.2.07.1 - Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion9.1<= 9.2.07.19.2.07.0020
10 Aug 2026Photo Album Plus <= 9.2.07.1 - Reflected Cross-Site Scripting6.1<= 9.2.07.19.2.07.0020
10 Aug 2026Photo Album Plus <= 9.2.09.1 - Missing Authorization4.3<= 9.2.09.19.2.09.0020
3 Aug 2026Photo Album Plus <= 9.2.07.1 - Unauthenticated Export ZIP File Deletion5.3<= 9.2.07.19.2.07.0020
28 Jul 2026WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter4.9<= 9.2.04.0029.2.04.0030
30 Jun 2026WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute6.4<= 9.1.13.0059.2.01.0010
30 Jun 2026WP Photo Album Plus <= 9.2.02.004 - Unauthenticated Stored Cross-Site Scripting7.2<= 9.2.02.0049.2.03.0010
17 Jun 2026WP Photo Album Plus <= 9.1.13.005 - Unauthenticated SQL Injection7.5<= 9.1.13.0059.2.01.0010
11 Jun 2026WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection7.5< 9.1.11.0019.1.11.0010
13 Apr 2026WP Photo Album Plus <= 9.1.08.001 - Unauthenticated SQL Injection7.5<= 9.1.08.0019.1.08.0020
6 Jan 2026WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting7.1<= 9.1.05.0089.1.05.009n/a
3 Oct 2025WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload5.4<= 9.0.11.0069.0.11.0070
10 Nov 2024WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay7.3<= 8.8.08.0078.9.01.0010
16 Oct 2024Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting6.1<= 8.8.05.0038.8.07.0041
11 Jul 2024WP Photo Album Plus <= 8.8.02.002 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 8.8.02.0028.8.02.0032
28 Jun 2024WP Photo Album Plus <= 8.8.00.002 - Reflected Cross-Site Scripting6.1<= 8.8.00.0028.8.00.00325

Source: Wordfence Intelligence.

Reputation

Average rating stayed at 5.0 between Q1 2024 and Q1 2025.

Rating distribution
5 star172
4 star12
3 star2
2 star2
1 star11
Latest low reviews

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP Photo Album Plus
4 May 2026621
11 May 20264,494
18 May 20261,294
25 May 2026842
1 Jun 2026729
8 Jun 20264,355
15 Jun 20267,462
22 Jun 20265,079
29 Jun 20261,064
6 Jul 20264,163
13 Jul 20264,518
20 Jul 20264,626
27 Jul 20267,384
3 Aug 20265,693
10 Aug 20264,485
17 Aug 20261,272
24 Aug 20261,009
31 Aug 20264,148
7 Sep 20264,818
14 Sep 20268,538
21 Sep 20261,567
28 Sep 20264,883
5 Oct 20261,326
12 Oct 20261,151
19 Oct 20264,906
26 Oct 20265,679
2 Nov 2026233

Weekly downloads over the last 4 weeks are 16% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

MetaSlider Gallery - Image Gallery, Lightbox Galleries, Video GalleriesScore 92 · 10,000+Gallery Custom LinksScore 91 · 30,000+Catch GalleryScore 91 · 10,000+Photoswipe MasonryScore 91 · 6,000+iPanorama 360 - Advanced Virtual Tour BuilderScore 91 · 4,000+

Facts

Version9.3.05.002
AuthorJacob N. Breetvelt
Added3 Feb 2010
Last updated27 Oct 2026
Active installs10,000+
Requires WordPress6.9
Tested up to7.1.4
Requires PHP5.5
CategoryContent Management > Blog & Article Publishing
Tagspdf, audio, photo, video, lightbox

Other plugins by this author: WP Sudoku Plus, Tweak Option, Page Navigator Widget, Page Load Ajax, Pagelog

Questions

Is WP Photo Album Plus still maintained?

WP Photo Album Plus was last updated on 27 Oct 2026. Its Canary status is Healthy.

Is WP Photo Album Plus safe?

WP Photo Album Plus has no open unpatched vulnerabilities on record. 22 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns WP Photo Album Plus?

The wordpress.org author is Jacob N. Breetvelt. Recent committers: opajaap. We have recorded no ownership change.

What can I use instead of WP Photo Album Plus?

Plugins in the same category with a higher Canary Score: MetaSlider Gallery - Image Gallery, Lightbox Galleries, Video Galleries, Gallery Custom Links, Catch Gallery, Photoswipe Masonry, iPanorama 360 - Advanced Virtual Tour Builder.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue