Photo Swipe link titles permit Author-level stored XSS
Photo Swipe through 4.1.1.1 lets an authenticated Author publish link markup whose data-size attribute activates the lightbox and whose title attribute contains an encoded script payload. The title attribute survives WordPress post-content filtering for users without unfiltered_html. When a visitor clicks the link, parseThumbnailElements() in js/photoswipe.js reads the title into the lightbox item's title property, and the bundled PhotoSwipe UI addCaptionHTMLFn() assigns that value to captionEl.children[0].innerHTML without escaping. The payload then executes in the viewer's browser, including an Administrator's session. This stored-content path does not use a separate plugin endpoint, action or request parameter.
- Component
- PhotoSwipe
- Plugin slug
photoswipe- Affected
- <= 4.1.1.1
- Safe version
- See mitigation notes
- Published
- Jul 29, 2026
This CVE was published Jul 29, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
No fixed public release is currently identified. Deactivate Photo Swipe until the vendor publishes a corrected release, or apply an application-level patch that treats lightbox captions as text rather than assigning author-controlled title content to innerHTML. Review Author-published links carrying data-size and suspicious encoded title values before an Administrator opens them.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered_html capability, an authenticated user with Author-level access can store a JavaScript payload that executes in the browser of any visitor, including an administrator, who clicks the link.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H