Photo Swipe
Photo Swipe (photoswipe) is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Jul 29, 2026; the highest published CVSS base score is 6.8.
photoswipeCVE-2026-13605: Photo Swipe link titles permit Author-level stored XSS
Photo Swipe through 4.1.1.1 lets an authenticated Author publish link markup whose data-size attribute activates the lightbox and whose title attribute contains an encoded script payload. The title attribute survives WordPress post-content filtering for users without unfiltered_html. When a visitor clicks the link, parseThumbnailElements() in js/photoswipe.js reads the title into the lightbox item's title property, and the bundled PhotoSwipe UI addCaptionHTMLFn() assigns that value to captionEl.children[0].innerHTML without escaping. The payload then executes in the viewer's browser, including an Administrator's session. This stored-content path does not use a separate plugin endpoint, action or request parameter.
| Safe version |
|
||
|---|---|---|---|
| Jul 29, 2026 |
CVE-2026-13605
Photo Swipe link titles permit Author-level stored XSS
Photo Swipe through 4.1.1.1 lets an authenticated Author publish link markup whose data-size attribute activates the lightbox and whose title attribute contains an encoded script payload. The title attribute survives WordPress post-content filtering for users without unfiltered_html. When a visitor clicks the link, parseThumbnailElements() in js/photoswipe.js reads the title into the lightbox item's title property, and the bundled PhotoSwipe UI addCaptionHTMLFn() assigns that value to captionEl.children[0].innerHTML without escaping. The payload then executes in the viewer's browser, including an Administrator's session. This stored-content path does not use a separate plugin endpoint, action or request parameter.
|
See mitigation notes |
CVE6.8
NVDPending
|