EUVD-2026-50116
GHSA-frxw-gm92-m8v8
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
S:C assigned because the payload executes under admin browser context, crossing security principals; A:N because XSS does not directly affect availability.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered_html capability, an authenticated user with Author-level access can store a JavaScript payload that executes in the browser of any visitor, including an administrator, who clicks the link.
AnalysisAI
Stored cross-site scripting in the PhotoSwipe WordPress plugin (all versions through 4.1.1.1) allows an authenticated Author-level user to plant a persistent JavaScript payload inside a link's title attribute, which the plugin writes unescaped into the page DOM as a lightbox caption. Any visitor - including site administrators - who clicks the link triggers payload execution in their browser, enabling session hijacking and full WordPress takeover. A publicly available proof-of-concept exists; no patched release has been identified at time of analysis.
Technical ContextAI
PhotoSwipe is a JavaScript lightbox gallery library packaged as a WordPress plugin (CPE: cpe:2.3:a:unknown:photoswipe:*:*:*:*:*:*:*:*). The plugin extracts the HTML title attribute from author-supplied anchor elements and injects it directly into the live DOM as a caption string when the lightbox opens. WordPress's built-in post-content sanitization strips script tags and event handlers for users lacking the unfiltered_html capability, but it does not strip or encode content inside title attributes, creating a sanitization bypass vector. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin performs no secondary HTML-encoding of the title value before DOM insertion, allowing embedded JavaScript to execute in the visitor's browser context.
RemediationAI
No vendor-released patch has been identified for PhotoSwipe ≤4.1.1.1 at time of analysis. The primary recommended action is to deactivate and remove the plugin immediately, eliminating the attack surface entirely at the cost of losing lightbox gallery functionality. As a compensating control for sites that cannot remove the plugin, restrict the Author role exclusively to fully trusted individuals - reducing the Author-role user count to zero closes the exploitation path since Contributors cannot publish posts independently without editor approval. WordPress site administrators should audit current Author-role assignments and demote any accounts held by untrusted parties to Contributor or lower. Monitor the WPScan advisory (https://wpscan.com/vulnerability/7ec73098-99eb-48cb-8ff6-a05110691117/) and the plugin's official WordPress repository page for a patched release.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today