PT-2025-43051 · WordPress · Photographers Galleries

Published 2025-10-22 · Updated 2025-10-22 · CVE-2025-11866

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Photographers galleries plugin for WordPress versions up to and including 1.1.8

Description The Photographers galleries plugin for WordPress is susceptible to Stored Cross-Site Scripting through multiple shortcode attributes, including w, h, raw css, and look. The issue arises from insufficient sanitization of user input and inadequate output escaping when these values are incorporated into HTML attributes and inline styles. This allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts will then execute whenever a user accesses the compromised page.

Recommendations Versions prior to 1.1.8 should be updated to a newer version that addresses this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11866

Affected Products

Photographers Galleries

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11866 · Security Note
• https://t.me/CVEtracker/35470 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9300af5d-7886-4f4e-8454-0dcf2d895fee?source=cve · Note
• https://plugins.trac.wordpress.org/browser/photographers-galleries/tags/1.1.8/includes/shortcodes.php#L61 · Note
• https://t.me/cveNotify/139826 · Telegram Post