Firelight Lightbox
| Version / range | Status | Type |
|---|---|---|
| 0 to before 2.3.24 | affected | semver |
Threat intelligence dashboard
CVE-2026-118438Unrated
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
Risk score
—
CVSS unavailable
- Vendor
- Not available
- Product
- Firelight Lightbox
- CWE
- CWE-79
- Published
- Oct 31, 2026
- Updated
- Oct 31, 2026
- CISA KEV
- Not flagged
Affected products and versions
Technical metrics
No CVSS metrics were provided.