medium6.8
CVE-2026-118438
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow …
Impact
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| FirelightWP | Firelight Lightbox | before 2.3.24 |
| Unknown | Firelight Lightbox | before 2.3.24 |