CVE-2026-13605

Name of the Vulnerable Software and Affected Versions PhotoSwipe WordPress plugin versions prior to 4.1.1.2

Description The plugin uses the title attribute of author-supplied link markup as a lightbox caption, which is written into the page DOM without escaping. Since the title attribute bypasses the post-content sanitization for users without the unfiltered html capability, an authenticated user with Author-level access can store a JavaScript payload. This payload executes in the browser of any visitor, including administrators, who clicks the link.

Recommendations Update the PhotoSwipe WordPress plugin to version 4.1.1.2 or later.