CVE-2025-12691
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Photonic Gallery & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox functionality in all versions up to and including 3.21 due to insufficient input sanitization and output escaping on user supplied caption attribute.
Risk Assessment
An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages that execute when a user accesses the injected page.
Recommendation
Update the Photonic Gallery & Lightbox plugin to a version later than 3.21.
Other vulnerabilities in Photonic Gallery & Lightbox
See all- CVE-2026-97290High
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions up to 3.36.
- CVE-2026-66434Medium
The Photonic Gallery & Lightbox plugin up to version 3.33 contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. This allows injection of malicious scripts.
Original NVD description (English source)
The Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox functionality in all versions up to, and including, 3.21 due to insufficient input sanitization and output escaping on user supplied caption attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS