CVE-2026-13605

The PhotoSwipe WordPress plugin's caption feature is vulnerable due to its failure to properly sanitize user-submitted title attributes. When an author with sufficient privileges inserts malicious code into a link's title attribute, it can be injected into the page's DOM without being escaped. This allows an attacker to execute arbitrary JavaScript in the browser of any visitor who clicks the compromised link.

Based on public CVE data (MITRE/NVD).