Photo Swipe <= 4.1.1.1 – Author+ Stored XSS via title Attribute | CVE 2026-13605

Description

The plugin uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered_html capability, an authenticated user with Author-level access can store a JavaScript payload that executes in the browser of any visitor, including an administrator, who clicks the link.

Proof of Concept

Prerequisites: an Author account (a default WordPress role that lacks unfiltered_html); no plugin configuration is required.

1) As an Author, publish a post containing this markup:
<a data-size="350x350" href="" title="&lt;img src=x onerror=alert(document.domain)&gt;"><img src="https://VICTIM/wp-content/uploads/any-image.jpg"></a>

2) View the published post source: the title="&lt;img...&gt;" payload is present (it survived wp_kses_post).

3) As any visitor (including a logged-in administrator), open the post and click the image. The PhotoSwipe lightbox reads the decoded title and assigns it to the caption element's innerHTML, injecting a live <img src=x onerror=...> that runs alert(document.domain) in the viewer's session.