Stored Cross-Site Scripting Vulnerability in Photographers Galleries Plugin for WordPress
CVE-2025-11866

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Photographers Galleries
Vendor
CVE Published:
22 October 2025

What is CVE-2025-11866?

The Photographers Galleries plugin for WordPress exposes users to Stored Cross-Site Scripting vulnerabilities due to inadequate sanitization of user inputs. This vulnerability affects all versions up to and including 1.1.8. Authenticated users with contributor-level access can exploit this flaw by injecting arbitrary web scripts via multiple shortcode attributes such as w, h, raw_css, and look. If exploited, these injected scripts can execute on pages viewed by users, jeopardizing site security and user trust.

Affected Version(s)

Photographers galleries * <= 1.1.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/photographers-...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ
JSON
.