CVE-2013-6837

Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

• CWE-79

• http://cxsecurity.com/issue/WLB-2013110149Exploit
• http://themeforest.net/forums/thread/security-vulnerability-affecting-prettyphoto-jquery-script/181180
• http://themeforest.net/item/udesign-responsive-wordpress-theme/253220
• http://www.no-margin-for-errors.com/projects/prettyphoto-jquery-lightbox-clone/
• http://www.perucrack.net/2014/07/haciendo-un-xss-en-plugin-prettyphoto.htmlURL Repurposed
• http://www.rafayhackingarticles.net/2013/05/kali-linux-dom-based-xss-writeup.htmlExploit
• https://github.com/Duncaen/prettyphoto/commit/3ef0ddfefebbcc6bbe9245f9cea87e26838e9bbcExploit, Patch
• http://cxsecurity.com/issue/WLB-2013110149Exploit
• http://themeforest.net/forums/thread/security-vulnerability-affecting-prettyphoto-jquery-script/181180
• http://themeforest.net/item/udesign-responsive-wordpress-theme/253220
• http://www.no-margin-for-errors.com/projects/prettyphoto-jquery-lightbox-clone/
• http://www.perucrack.net/2014/07/haciendo-un-xss-en-plugin-prettyphoto.htmlURL Repurposed
• http://www.rafayhackingarticles.net/2013/05/kali-linux-dom-based-xss-writeup.htmlExploit
• https://github.com/Duncaen/prettyphoto/commit/3ef0ddfefebbcc6bbe9245f9cea87e26838e9bbcExploit, Patch

Published

Dec 19, 2013

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-6831PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier p…
• CVE-2013-6832The nand_ioctl function in sys/dev/nand/nand_geom.c in the n…
• CVE-2013-6833The qls_eioctl function in sys/dev/qlxge/qls_ioctl.c in the …
• CVE-2013-6834The ql_eioctl function in sys/dev/qlxgbe/ql_ioctl.c in the k…
• CVE-2013-6835TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari…
• CVE-2013-6836Heap-based buffer overflow in the ms_escher_get_data functio…
• CVE-2013-6838An unspecified Enghouse Interactive Professional Services "a…
• CVE-2013-6839SQL injection vulnerability in InstantSoft InstantCMS 1.10.3…
• CVE-2013-6840Siemens COMOS before 9.2.0.8.1, 10.0 before 10.0.3.1.40, and…
• CVE-2013-6852Cross-site request forgery (CSRF) vulnerability in html/json…
• CVE-2013-6853Cross-site scripting (XSS) vulnerability in clickstream.js i…
• CVE-2013-6858Multiple cross-site scripting (XSS) vulnerabilities in OpenS…