Embed Google Photos album

Embed Google Photos album has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Server-Side Request Forgery (SSRF).

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

2 independent researchers contributed these findings, one record each. Embed Google Photos album is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all Embed Google Photos album vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2026-14290

Embed Google Photos Album Easily <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Embed Google Photos album banner
Latestv2.2.2

Embed Google Photos album

pavex

Author

pavex

4.4(15)
88/100
Last Updated
2026-08-04 (1mo ago)
Active Installs
3,000+
Downloads
50,394
Requires WP
5.0+
Requires PHP
5.3+
Tested up to
WP 7.0.4
Created
2018-03-10 (9y ago)

This plugin requires a shared Google Photos album link to view photos using gallery/player or carousel. This widget is free to use for WordPress users. It is very easy to use. Just write a shortcode to your post and include a link of shared Google Photos album as a parameter. Instead of shortcode, html code with links to the photo will be inserted and it will be decorated using Public album javascript. Example [embed-google-photos-album link="https://photos.app.goo.gl/CSV7NDstShTUwUZq5"] [embed-google-photos-album link="https://photos.app.goo.gl/CSV7NDstShTUwUZq5" mode="carousel"] [embed-google-photos-album link="https://photos.app.goo.gl/CSV7NDstShTUwUZq5" mediaitems-cover="true"] [embed-google-photos-album link="https://photos.app.goo.gl/CSV7NDstShTUwUZq5" background-color="#007acc"] link – [string] public link of Google Photos album mode – [carousel | gallery-player] setup decorator mode, default id gallery-player width – [int | &#8216;auto’] set widget width in pixel or “auto” to stretch to 100% height – [int | &#8216;auto’] set widget height in pixels or “auto” to stretch to 100% image-width – [int] image max-width in pixels, default is 1920 image-height – [int] image max-height in pixels, default is 1080 autoplay – [true | false] start slideshow in normal view (currently not allowed by decorator) delay – [true | false] slideshow delay in seconds, default is 5 seconds. repeat – [true | false] Enable or disable repeat slideshow, delfault is true mediaitems-aspectration – [true | false], Keep asspect ration of images delfault is true mediaitems-enlarge – [true | false], Turn on/off image enlarge, delfault is true mediaitems-stretch – [true | false], Tunr on/off image stretch, delfault is true mediaitems-cover – [true | false], Cover full canvas. Combine with aspect ratio parameter. Delfault is false background-color – [#RRGGBB | transparent], Setup background color to RGB or transparent. Default is #000000 expiration – [int] setup expiration timeout in secons; default is 0; min. custom value is 86400s (experimental property) This widget, unsupported some features like a picture’s timestamp and captions. For a more detailed description of the component, go to WordPress Google Photos album plugin. In some cases, it may be better to use the following code directly in the template. <?php echo (new Pavex_embed_google_photos_album()) -> getcode( 'https://photos.app.goo.gl/CSV7NDstShTUwUZq5', 0, 480, 1920, 1080 ); ?> How do I update my album? The album will update automatically as soon as you save or update your post. Javascript decorator External javascript decorator is stored on CDN and loading and running of them is optimized for performance. Javascript widget can be used without photos from Google photos. Detailed information on how to use javascript is available in one of older posts about carusel slideshow on my blog. About Public album photo sharing website Public album is now a photo sharing website and service for sharing short photosets available in single user profile. The service can also be used as an alternative to public Google Photos. It is very suitable for the blogs focused mainly on photos. For example, a photoblog or a online bookmark manager. Important links Public album sharing website https://www.publicalbum.org Blog https://www.publicalbum.org/blog Facebook https://www.facebook.com/publicalbumapp Reabr.com online bookmark manager

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C