EIP-2026-111297

This exploit demonstrates a persistent XSS vulnerability in the Piwigo User Tag plugin (version 0.9.0). The attacker can inject malicious JavaScript via the 'tags' parameter, which is stored in the server's database and executed when other users view the tagged photo.