The PhotoSwipe WordPress plugin through version 4.1.1.1 improperly handles the title attribute of author-supplied link markup by using it as a lightbox caption without escaping it before writing into the page DOM. Since the title attribute is not sanitized for users lacking unfiltered_html capability, an authenticated user with Author-level privileges can store a JavaScript payload. This payload executes in the browser context of any visitor, including administrators, who interact with the link, resulting in a stored cross-site scripting vulnerability (CWE-79). The CVSS v3.1 base score is 6.8, indicating a medium severity with network attack vector, low attack complexity, high privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

An authenticated user with Author-level access can inject malicious JavaScript code that executes in the browsers of other users, including administrators, when they click the affected link. This can lead to compromise of user sessions, theft of sensitive information, or other malicious actions within the context of the affected website. The vulnerability affects confidentiality, integrity, and availability of the system as indicated by the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Author-level user capabilities where possible and avoid clicking suspicious links in the PhotoSwipe plugin context. Monitor vendor channels for updates and apply official fixes when released.