CVE-2026-13605
Received Received - Intake

Cross-Site Scripting in PhotoSwipe WordPress Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: WPScan

Description
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered_html capability, an authenticated user with Author-level access can store a JavaScript payload that executes in the browser of any visitor, including an administrator, who clicks the link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-29
Last Modified
2026-07-29
Generated
2026-07-29
AI Q&A
2026-07-29
EPSS Evaluated
N/A
NVD
CVE-2026-13605
EUVD
EUVD-2026-50116

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
photoswipe photoswipe to 4.1.1.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the PhotoSwipe WordPress plugin up to version 4.1.1.1. An authenticated user with Author-level access can inject malicious JavaScript via the title attribute of a link. The payload survives WordPress's post-content sanitization because the user lacks the unfiltered_html capability. When a visitor clicks the link, the PhotoSwipe lightbox renders the title as HTML, executing the embedded script in their browser.

Detection Guidance

Check if the PhotoSwipe WordPress plugin version is 4.1.1.1 or lower. Inspect WordPress posts for links with title attributes containing suspicious JavaScript payloads. Use WPScan to scan for vulnerable versions.

Impact Analysis

An attacker with Author access could inject JavaScript that steals session cookies, redirects users to malicious sites, or performs actions on their behalf. Visitors, including administrators, are at risk when viewing posts containing the crafted link. The script executes in their browser context, potentially compromising their accounts or data.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. If exploited, it may result in data breaches, triggering compliance violations and potential fines under these regulations.

Mitigation Strategies

Update the PhotoSwipe plugin to the latest version if available. Remove unfiltered_html capability from Author roles. Review and sanitize all posts for malicious scripts. Consider disabling the plugin temporarily until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13605. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart