Back
CVE-2013-6837
Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows…
Medium4.3EPSS 3.1%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
- EPSS (exploitation in 30 days)
- 3.1% · top 12% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Weakness
Affected products
n/a
- affected n/a
References (7)
- http://www.rafayhackingarticles.net/2013/05/kali-linux-dom-based-xss-writeup.html (opens in a new tab)x_refsource_MISCx_transferred
- http://www.no-margin-for-errors.com/projects/prettyphoto-jquery-lightbox-clone/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- http://themeforest.net/item/udesign-responsive-wordpress-theme/253220 (opens in a new tab)x_refsource_CONFIRMx_transferred
- http://themeforest.net/forums/thread/security-vulnerability-affecting-prettyphoto-jquery-script/181180 (opens in a new tab)x_refsource_MISCx_transferred
- http://cxsecurity.com/issue/WLB-2013110149 (opens in a new tab)x_refsource_MISCx_transferred
- http://www.perucrack.net/2014/07/haciendo-un-xss-en-plugin-prettyphoto.html (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/Duncaen/prettyphoto/commit/3ef0ddfefebbcc6bbe9245f9cea87e26838e9bbc (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2013-6837)Record last updated .