CVE-2026-13605 in PhotoSwipe Plugin
Summary
by MITRE • 07/29/2026
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered_html capability, an authenticated user with Author-level access can store a JavaScript payload that executes in the browser of any visitor, including an administrator, who clicks the link.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability exists within the PhotoSwipe WordPress plugin version 4.1.1.1 and earlier, where the plugin improperly handles the title attribute from author-supplied link markup. The flaw stems from insufficient input sanitization and output escaping mechanisms that allow malicious content to persist in the document object model. When an authenticated user with author-level privileges creates or modifies content containing links with malicious title attributes, these attributes are directly embedded into the page DOM without proper HTML escaping or context-appropriate sanitization. The vulnerability leverages WordPress's capability system where users lacking unfiltered_html permission still retain the ability to inject content that bypasses standard post-content sanitization processes. This creates a persistent cross-site scripting vector that specifically targets the title attribute of hyperlink elements within post content.
The technical execution path involves an author-level user crafting malicious link markup with a title attribute containing JavaScript code, which then gets stored in the WordPress database. When visitors access pages containing this content, particularly administrators who may have elevated privileges and thus greater potential impact, clicking on the affected links triggers the embedded JavaScript payload within the browser context. The vulnerability operates through the principle of reflected cross-site scripting where the malicious script is stored server-side and executed client-side when the page loads. This represents a classic persistent XSS flaw that can be exploited for session hijacking, credential theft, or privilege escalation attacks against authenticated users with higher permissions.
The operational impact extends beyond simple content manipulation as it enables attackers to compromise administrator accounts through social engineering or automated exploitation of the stored XSS vulnerability. The vulnerability is particularly concerning because administrators often have elevated privileges and may interact with potentially malicious content without adequate security awareness. Attackers can leverage this vector to execute arbitrary JavaScript code in the context of high-privilege sessions, potentially leading to complete system compromise. This type of vulnerability aligns with CWE-79 (Cross-site Scripting) and follows attack patterns described in the ATT&CK framework under TA0001 Initial Access and TA0003 Persistence techniques. The vulnerability also demonstrates weaknesses in input validation and output encoding that are commonly exploited in web application security breaches.
Mitigation strategies should include immediate patching of the PhotoSwipe plugin to version 4.1.1.2 or later, which addresses the improper escaping of title attributes. Administrators should implement additional content filtering measures using plugins like Wordfence or Sucuri that provide enhanced sanitization capabilities beyond WordPress's default mechanisms. The recommended approach involves configuring WordPress to restrict author-level users from creating potentially dangerous content structures while maintaining necessary functionality. Security hardening practices should include implementing content security policies, regular security audits of user-generated content, and monitoring for suspicious link patterns in published content. Organizations should also consider implementing web application firewalls that can detect and block known XSS attack patterns targeting specific plugin vulnerabilities, as well as conducting regular penetration testing to identify similar flaws in other installed plugins or themes.