62 matches found
CVE-2026-14833
The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfilteredhtml capability to store JavaScript that runs...
EUVD-2026-51412
The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfilteredhtml capability to store JavaScript that runs...
CVE-2026-14833
CVE-2026-14833 corresponds to a stored XSS risk in the Lightbox with PhotoSwipe WordPress plugin prior to 5.9.0. The root cause is lack of sanitisation/escaping of a link data attribute when rendering the image lightbox caption, which allows users with author-level access (lacking unfiltered_html...
CVE-2026-14833 Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute
The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfilteredhtml capability to store JavaScript that runs...
CVE-2026-13605
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...
CVE-2026-13605
The vulnerability CVE-2026-13605 affects the PhotoSwipe WordPress plugin up to version 4.1.1.1. The root cause is that the plugin uses the title attribute from author-provided link markup as a lightbox caption and writes it into the DOM without escaping. Because the title survives post-content sa...
CVE-2026-13605 Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...
CVE-2026-13605 Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...
CVE-2026-13605
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...
EUVD-2026-50116
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...
PT-2026-65692
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered html...
DRUPAL-CONTRIB-2026-088
The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries using the provided image formatters. The module didn't sufficiently check access permissions, when viewing an image using the photoswipe image gallery...
CVE-2022-0750
The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnailwidth, thumbnailheight, maximagewidth, and maximageheight parameters found in the /photoswipe-masonry.php file which allows authenticated attackers t...
Malicious code in frontend-photoswipe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e08a30dcf287f7992949bf9a4870c6201c42b3aa3b59e0966a677899b4bca376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2025-33607
Malicious code in frontend-photoswipe npm...
MAL-2025-48281 Malicious code in frontend-photoswipe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e08a30dcf287f7992949bf9a4870c6201c42b3aa3b59e0966a677899b4bca376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2019-18546
Malware in sbrugna...
EUVD-2022-15813
Malicious code in bioql PyPI...
CVE-2024-5570
The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
CVE-2024-5473
The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...