CVE-2026-13605: CWE-79 Cross-Site Scripting (XSS) in PhotoSwipe
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered_html capability, an authenticated user with Author-level access can store a JavaScript payload that executes in the browser of any visitor, including an administrator, who clicks the link.
AI Analysis
Technical Summary
The PhotoSwipe WordPress plugin up to version 4.1.1.1 improperly handles the title attribute in author-supplied link markup by inserting it into the DOM without escaping. Since this attribute is not sanitized for users lacking unfiltered_html capability, an authenticated user with Author-level permissions can store malicious JavaScript code. This code executes when any user, including administrators, clicks the link, resulting in a stored Cross-Site Scripting (CWE-79) vulnerability.
Potential Impact
An authenticated user with Author-level access can inject JavaScript that executes in the browsers of other users, including administrators, potentially leading to session hijacking, privilege escalation, or other malicious actions within the context of the affected site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level user capabilities or avoid using the affected plugin version. Monitor official PhotoSwipe or WordPress plugin advisories for updates and apply patches promptly once released.
CVE-2026-13605: CWE-79 Cross-Site Scripting (XSS) in PhotoSwipe
Description
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered_html capability, an authenticated user with Author-level access can store a JavaScript payload that executes in the browser of any visitor, including an administrator, who clicks the link.
CVSS v3.1
Score 6.8medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The PhotoSwipe WordPress plugin up to version 4.1.1.1 improperly handles the title attribute in author-supplied link markup by inserting it into the DOM without escaping. Since this attribute is not sanitized for users lacking unfiltered_html capability, an authenticated user with Author-level permissions can store malicious JavaScript code. This code executes when any user, including administrators, clicks the link, resulting in a stored Cross-Site Scripting (CWE-79) vulnerability.
Potential Impact
An authenticated user with Author-level access can inject JavaScript that executes in the browsers of other users, including administrators, potentially leading to session hijacking, privilege escalation, or other malicious actions within the context of the affected site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level user capabilities or avoid using the affected plugin version. Monitor official PhotoSwipe or WordPress plugin advisories for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-29T08:32:22.616Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a699fb99c2644c7f814eacb
Added to database: 07/29/2026, 06:37:45 UTC
Last enriched: 07/29/2026, 11:54:30 UTC
Last updated: 07/29/2026, 21:32:56 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.