CVE-2025-13612: WordPress Gallery Plugin XSS Vulnerability

CVE-2025-13612 Overview

The Album and Image Gallery plus Lightbox plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the aigpl-gallery-album shortcode. All versions up to and including 2.1.7 are affected due to insufficient input sanitization and output escaping on user-supplied attributes. This vulnerability enables authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages that execute whenever a user accesses the injected page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the browsers of site visitors, potentially leading to session hijacking, credential theft, or malware distribution.

Affected Products

• Album and Image Gallery plus Lightbox plugin for WordPress versions ≤ 2.1.7
• WordPress installations using the vulnerable aigpl-gallery-album shortcode
• Any WordPress site with contributor-level or higher user accounts with malicious intent

Discovery Timeline

• 2026-02-19 - CVE CVE-2025-13612 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-13612

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the aigpl-gallery-album shortcode handler of the Album and Image Gallery plus Lightbox plugin. The plugin fails to properly sanitize and escape user-supplied attributes when processing shortcode parameters, allowing malicious JavaScript code to be stored in the WordPress database and rendered to all visitors viewing the affected page.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents a common weakness in web applications where user-controllable input is not properly validated before being included in dynamic web content. The attack can be executed remotely over the network and requires low privileges (contributor-level access), making it accessible to authenticated users who may not have full administrative rights.

Root Cause

The root cause is insufficient input sanitization and output escaping within the shortcode processing logic. Specifically, the aigpl-gallery-album.php shortcode file and associated template files (design-1.php) do not adequately filter or encode user-supplied attribute values before rendering them in HTML output. This allows attackers to craft shortcode attributes containing JavaScript payloads that are stored and later executed in visitors' browsers.

Attack Vector

The attack requires an authenticated user with at least contributor-level privileges on the WordPress site. The attacker creates or edits a post or page containing the vulnerable aigpl-gallery-album shortcode with malicious attribute values. When the content is saved, the malicious payload is stored in the database. Subsequently, any user who views the page will have the malicious script executed in their browser context.

The vulnerability is exploited through the network without requiring any user interaction beyond normal page viewing. Because the script is stored persistently, this attack can affect multiple victims over an extended period until the malicious content is removed or the vulnerability is patched.

The vulnerable code paths can be reviewed in the WordPress Plugin Shortcode File and template design files. For detailed technical analysis, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-13612

Indicators of Compromise

• Unusual or obfuscated JavaScript code within post or page content containing the aigpl-gallery-album shortcode
• Shortcode attributes containing script tags, event handlers (e.g., onerror, onload), or JavaScript URIs
• Unexpected outbound network connections from visitor browsers to unknown domains
• Reports of browser warnings or unexpected pop-ups when viewing gallery pages

Detection Strategies

• Scan WordPress database content for suspicious patterns within aigpl-gallery-album shortcode usage, particularly looking for <script>, javascript:, or HTML event handlers
• Implement Web Application Firewall (WAF) rules to detect XSS payloads in shortcode parameters
• Monitor server logs for content modifications by contributor-level users that include potentially malicious scripts
• Use browser-based Content Security Policy (CSP) violation reporting to detect unexpected script execution

Monitoring Recommendations

• Enable WordPress activity logging to track all content modifications, especially those involving shortcodes
• Configure real-time alerts for posts or pages edited by contributor-level users containing gallery shortcodes
• Deploy endpoint detection solutions to monitor for signs of XSS exploitation such as cookie exfiltration or DOM manipulation
• Regularly audit user accounts with contributor-level access or above for unauthorized activity

How to Mitigate CVE-2025-13612

Immediate Actions Required

• Update the Album and Image Gallery plus Lightbox plugin to a version newer than 2.1.7 where the vulnerability has been patched
• Review and audit all existing posts and pages using the aigpl-gallery-album shortcode for potentially malicious content
• Temporarily restrict contributor-level access or disable the vulnerable shortcode functionality until patching is complete
• Implement a Web Application Firewall with XSS protection rules to provide an additional layer of defense

Patch Information

The vulnerability has been addressed in a security update for the Album and Image Gallery plus Lightbox plugin. Administrators should update to the latest available version through the WordPress plugin repository. The patch changes can be reviewed in the WordPress Plugin Change Set.

Workarounds

• Temporarily deactivate the Album and Image Gallery plus Lightbox plugin if an immediate update is not possible
• Restrict user roles by removing contributor-level access from untrusted accounts until the patch is applied
• Implement Content Security Policy headers to mitigate the impact of any stored XSS payloads that may already exist
• Manually review and sanitize any existing content that uses the aigpl-gallery-album shortcode

# WordPress configuration to enhance security
# Add to wp-config.php to restrict contributors from editing published content
define('DISALLOW_FILE_EDIT', true);

# Consider implementing CSP headers in .htaccess or web server config
# Header set Content-Security-Policy "script-src 'self';"