Prettyphoto Vulnerabilities

The prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 1.2.4

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58808 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Babar prettyPhoto allows Stored XSS. This issue affects prettyPhoto: from n/a through 1.2.4.

Affected:

up to 1.2.4

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58808 on NVD →

[en] The WordPress prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

Affected:

up to 1.2.3

Fix:

No patched version reported

Disclosed:

Jun 6, 2024

CVE-2024-5162 on NVD →

The WordPress prettyPhoto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje...

CVSS:

6.4

Affected:

up to 1.2.3

Fixed in:

1.2.4

Disclosed:

Jun 5, 2024

CVE-2024-5162 on NVD →

The prettyPhoto plugin for WordPress is vulnerable to DOM Cross-Site Scripting in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 1.1

Fixed in:

1.2

Disclosed:

May 5, 2015

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin.

Affected:

up to 1.2

Fixed in:

1.2

Disclosed:

May 5, 2015

The prettyPhoto plugin for WordPress is vulnerable to DOM Cross-Site Scripting in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 1.2

Fixed in:

1.2

Disclosed:

May 5, 2015

The WordPress prettyPhoto WordPress plugin was affected by a DOM Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 1.2

Fixed in:

1.2