CVE-2026-13605 Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...

CVE-2026-13605 Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...

EUVD-2026-50116

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...

CVE-2026-13605

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...

CVE-2026-13605: Improper Neutralization of Input During Web Page Generation

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...

PT-2026-65692

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered html...

DRUPAL-CONTRIB-2026-088

The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries using the provided image formatters. The module didn't sufficiently check access permissions, when viewing an image using the photoswipe image gallery...

PT-2026-63541

Name of the Vulnerable Software and Affected Versions PhotoSwipe - Responsive JavaScript Modal Image Gallery versions 0.0.0 through 3.2.0 Description A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails t...

CVE-2022-0750

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnailwidth, thumbnailheight, maximagewidth, and maximageheight parameters found in the /photoswipe-masonry.php file which allows authenticated attackers t...

Malicious code in frontend-photoswipe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e08a30dcf287f7992949bf9a4870c6201c42b3aa3b59e0966a677899b4bca376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-33607

Malicious code in frontend-photoswipe npm...

MAL-2025-48281 Malicious code in frontend-photoswipe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e08a30dcf287f7992949bf9a4870c6201c42b3aa3b59e0966a677899b4bca376 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2019-18546

Malware in sbrugna...

EUVD-2022-15813

Malicious code in bioql PyPI...

CVE-2024-5570

The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...

CVE-2024-5473

The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2019-9168

WooCommerce before 3.5.5 allows XSS via a Photoswipe caption...

WordPress Simple Photoswipe plugin <= 0.1 - Subscriber+ Arbitrary Settings Update vulnerability

Subscriber+ Arbitrary Settings Update vulnerability discovered by Felipe Caon in WordPress Plugin Simple Photoswipe versions = 0.1...

WordPress Simple Photoswipe Plugin <= 0.1 is vulnerable to Settings Change

Software Simple Photoswipe Type Plugin Vulnerable versions = 0.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-5570 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 461ac97ab0b1 Credits Felipe Caon Required privilege...

CVE-2024-5570

The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...