Unrated
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens...
CVE-2026-118165
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| CVE | Firelight Lightbox |
< 2.3.23 |
2.3.23 |
Original description The description as published by the source.
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com