Skip to content
Sign in
6.4 Medium

CVE-2025-13612 The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

Description

The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `aigpl-gallery-album` shortcode in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product Affected versions Fixed in
Album and Image Gallery Plus Lightbox 2.1 earliest → 2.1.7 No fix stated

Other CVEs of Album and Image Gallery Plus Lightbox

The 3 CVEs of Album and Image Gallery Plus Lightbox →
CVE-2026-6443 All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions 9.8 Critical CVE-2024-4194 The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all… 6.5 Medium
Track this CVE