The PhotoSwipe plugin allows an authenticated Author to embed a link with a title attribute that is not escaped when rendered into the page. When a visitor clicks the link to open the lightbox, the unescaped title value is executed as JavaScript, enabling stored cross‑site scripting. This flaw allows arbitrary JavaScript execution in visitors’ browsers and is based on CWE‑79.

WordPress sites that have the PhotoSwipe plugin version 4.1.1.1 or earlier installed are affected. The vulnerability exists regardless of active theme, as the plugin inserts the title caption directly into the DOM.

The CVSS score is 6.8, indicating moderate risk. The EPSS score is below 1%, suggesting a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. An attacker needs only Author‑level access to the WordPress site to store malicious content; any subsequent visitor to the page will be affected when the link is clicked. No network privilege or remote code execution is required, but the impact on the user’s browser is significant.