6.8
MediumCVSS 3.1 · from CISA
CVE-2026-118438
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
Firelight Lightbox · Cross-site scripting · CWE-79AffectedFirelight Lightbox
FixUpdate to 2.3.24 or newer
PublishedOct 31, 06:00 · WPScan
Scored6.8 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
From WPScan
Affected and fixed versions
ProductAffectedFixed inFirelight Lightboxbefore 2.3.242.3.24
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known