CVE-2025-13612

Description

The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `aigpl-gallery-album` shortcode in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED Reserved 2025-11-24 | Published 2026-02-19 | Updated 2026-02-19 | Assigner Wordfence

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Timeline

Credits

Muhammad Yudha - DJ finder

References

www.wordfence.com/...-d9b0-4be3-8dc4-d7dd56f37c1c?source=cve

plugins.trac.wordpress.org/...rtcode/aigpl-gallery-album.php

plugins.trac.wordpress.org/...6/templates/album/design-1.php

plugins.trac.wordpress.org/...6/templates/album/design-1.php

plugins.trac.wordpress.org/...lightbox&sfp_email=&sfph_mail=

cve.org (CVE-2025-13612)

nvd.nist.gov (CVE-2025-13612)

Download JSON