Cross-Site Scripting Vulnerability in PhotoSwipe Plugin for WordPress
CVE-2026-13605
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 29 July 2026
Badges
What is CVE-2026-13605?
The PhotoSwipe WordPress plugin is susceptible to a cross-site scripting (XSS) vulnerability due to improper handling of the title attribute in author-supplied link markup. The plugin writes this title attribute as a lightbox caption into the page DOM without applying proper escaping. This oversight allows an authenticated user with Author-level access to inject a malicious JavaScript payload into the page. As a result, when any visitor, including administrators, clicks on the affected link, the payload executes within their browser, potentially compromising the security of the site and its users.
Affected Version(s)
PhotoSwipe 0 <= 4.1.1.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.