CVE-2026-13605 Overview
CVE-2026-13605 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the PhotoSwipe WordPress plugin through version 4.1.1.1. The plugin reuses the title attribute of author-supplied link markup as a lightbox caption and writes it into the page DOM without output escaping. The title attribute survives post-content sanitization applied to accounts without the unfiltered_html capability. An authenticated user with Author-level access can store a JavaScript payload that executes in any visitor's browser, including an administrator's, when the link is clicked.
Critical Impact
Authenticated Author-level attackers can persist JavaScript that executes in administrator sessions, enabling account takeover of the WordPress site.
Affected Products
- PhotoSwipe WordPress plugin, all versions through 4.1.1.1
Discovery Timeline
- 2026-07-29 - CVE-2026-13605 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-13605
Vulnerability Analysis
The PhotoSwipe plugin enhances WordPress galleries by rendering images inside a JavaScript lightbox. To display captions, the plugin reads the title attribute from anchor tags authored inside post content and injects that value into the lightbox DOM. The injection path does not apply HTML entity encoding to the attribute value before it is rendered as caption text.
WordPress applies kses-based post-content sanitization to users without the unfiltered_html capability, which normally blocks inline event handlers and <script> tags. However, the title attribute is preserved by the default allowlist because it is a benign attribute in standard HTML. Attackers embed JavaScript inside the title attribute value and rely on PhotoSwipe's client-side rendering to convert the stored string into executable script context.
Exploitation requires an authenticated Author account and user interaction from a victim who clicks the crafted gallery link. When the victim is an administrator, the payload runs with administrator privileges in the browser and can create new users, modify plugins, or exfiltrate session data.
Root Cause
The root cause is missing output escaping on a post-content attribute that is transferred from static HTML into a JavaScript-controlled rendering context. The plugin trusts sanitization performed by WordPress core on post content, but core sanitization treats the title attribute as safe text rather than as untrusted script input.
Attack Vector
The attack is delivered over the network by an authenticated Author-level user. The attacker publishes a post containing an anchor tag whose title attribute holds a JavaScript payload. A privileged visitor loads the post and clicks the link, triggering the PhotoSwipe lightbox and executing the payload. See the WPScan Vulnerability Report for advisory details.
No verified proof-of-concept code is published in the referenced advisory. The vulnerability mechanism is described in prose above rather than reproduced as an exploit snippet.
Detection Methods for CVE-2026-13605
Indicators of Compromise
- Post or page revisions authored by non-administrator accounts that contain anchor tags with title attributes holding JavaScript keywords such as javascript:, onerror, onload, or <script.
- Unexpected creation of administrator accounts or plugin installations shortly after a privileged user viewed a gallery page.
- Outbound browser requests from administrator sessions to attacker-controlled domains referenced inside stored title attributes.
Detection Strategies
- Query the wp_posts table for post_content values that match anchor tags with title attributes containing script-like patterns.
- Review WordPress audit logs for posts published or updated by Author-level accounts that also include PhotoSwipe gallery shortcodes.
- Inspect browser telemetry from administrator workstations for script execution originating from the site's own DOM but referencing external resources.
Monitoring Recommendations
- Alert on new posts or edits by non-administrator users when the content contains title=" attribute values longer than a defined threshold.
- Monitor administrator session activity following visits to author-authored gallery pages, focusing on privilege changes and REST API calls to /wp-json/wp/v2/users.
- Track PhotoSwipe plugin versions across managed WordPress sites and flag any instance running 4.1.1.1 or earlier.
How to Mitigate CVE-2026-13605
Immediate Actions Required
- Update the PhotoSwipe WordPress plugin to a version later than 4.1.1.1 once the maintainer publishes a fix, or deactivate the plugin if no patched release is available.
- Audit all Author-level accounts and remove or downgrade any account that does not require publishing rights.
- Review recent posts from Author-level accounts for anchor tags with suspicious title attributes and remove offending content.
Patch Information
At the time of publication, the NVD entry references the WPScan Vulnerability Report as the authoritative source. Verify the current fixed version on that advisory before upgrading.
Workarounds
- Deactivate the PhotoSwipe plugin until a patched version is confirmed.
- Restrict the Author role so untrusted contributors cannot publish HTML that reaches the PhotoSwipe rendering path.
- Deploy a Content Security Policy that disallows inline script execution on pages that render user-authored gallery content.
# Example: list installed PhotoSwipe plugin version using WP-CLI
wp plugin get photoswipe --field=version
# Example: deactivate the plugin as a temporary workaround
wp plugin deactivate photoswipe
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
