CVE-2013-6837: Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPh...

Security readout for executives and security teams

CVE-2013-6837 is a cross-site scripting issue in prettyPhoto, a jQuery lightbox script. A vulnerable site could let an attacker make a crafted URL run unwanted script in a visitor’s browser. This is mainly a website trust, session, and user-data risk, especially for older sites and themes bundling prettyPhoto. Exposure is most likely on legacy websites, WordPress themes, or static assets that bundle prettyPhoto 3.1.4 or earlier. The CVE record lists affected vendor and product as unavailable, so asset discovery must focus on file presence and version evidence rather than product names alone. Treat this as a targeted hygiene item for legacy web estates, not an emergency without evidence of active exploitation. Prioritize internet-facing sites, administrator-facing pages, and customer portals where browser-session compromise would create business impact. Mitigation focus: Inventory all public sites for bundled js/jquery.prettyPhoto.js files.; Remove prettyPhoto where the lightbox feature is no longer needed.; Update or replace prettyPhoto using vendor or theme maintainer guidance..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.