Stored Cross-Site Scripting Vulnerability in Photonic Gallery & Lightbox Plugin for WordPress

CVE-2025-12691

What is CVE-2025-12691?

The Photonic Gallery & Lightbox plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through its lightbox feature. This flaw arises from inadequate input sanitization and output escaping for the caption attribute supplied by users. An authenticated attacker with contributor-level access can exploit this vulnerability to inject arbitrary web scripts, which will execute on any user accessing the compromised page, potentially compromising user data and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References