{"id":"CVE-2026-118165","kind":"vulnerability","aliases":["CVE-2026-118165"],"related":[],"title":"Firelight Lightbox WordPress plugin: unescaped link URLs enable stored XSS","description":"The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.","summary":"The Firelight Lightbox WordPress plugin before 2.3.23 does not escape link URLs in its Classic lightbox before inserting them into pages as HTML. A Contributor-level user can store a crafted link that runs scripts in the browser of visitors who click it.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firelight-lightbox","package","wordpress"],"not_affected_if":["classic-lightbox-unused","plugin-version-2.3.23-or-later"],"how_to_check":"- Check the installed version of the Firelight Lightbox plugin in the WordPress admin plugins list, or `wp plugin get firelight-lightbox --field=version` if WP-CLI is available.\n- Confirm whether the Classic lightbox option is used on the site.","fix":"- Firelight Lightbox plugin: `2.3.23` or later (per the NVD description, versions before 2.3.23 are affected).","status":"open","published_at":"2026-10-30T06:16:47+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","triaged_at":"2026-10-30T06:29:56+00:00","updated_at":"2026-10-30T06:29:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T06:29:56Z","model":"claude-haiku-5-5","output":{"fix":"- Firelight Lightbox plugin: `2.3.23` or later (per the NVD description, versions before 2.3.23 are affected).","reach":"internet","title":"Firelight Lightbox WordPress plugin: unescaped link URLs enable stored XSS","impact":"medium","summary":"The Firelight Lightbox WordPress plugin before 2.3.23 does not escape link URLs in its Classic lightbox before inserting them into pages as HTML. A Contributor-level user can store a crafted link that runs scripts in the browser of visitors who click it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","firelight-lightbox"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in visitors' browsers after they click a link","analyst_note":"","how_to_check":"- Check the installed version of the Firelight Lightbox plugin in the WordPress admin plugins list, or `wp plugin get firelight-lightbox --field=version` if WP-CLI is available.\n- Confirm whether the Classic lightbox option is used on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-version-2.3.23-or-later","classic-lightbox-unused"],"who_is_affected":"WordPress sites running the Firelight Lightbox plugin before 2.3.23 that use its Classic lightbox. Exposure needs a contributor-level account on the site and a visitor who clicks a crafted link; sites without the plugin or with a patched version can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4126,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118165':13A,16A '-2026':12A,15A '2.3.23':28B,71C 'allow':95C 'attack':111C 'browser':60B 'classic':36B,83C 'click':64B,115C 'contributor':47B,103C 'contributor-level':46B 'could':94C 'craft':53B,117C 'cross':108C 'cross-sit':107C 'cve':11A,14A 'enabl':8A 'escap':31B,74C 'firelight':1A,18B,23B,66C 'firelight-lightbox':17B 'html':44B,92C 'insert':39B,86C 'level':48B 'lightbox':2A,19B,24B,37B,67C,84C 'link':6A,32B,54B,78C,118C 'low':101C 'open':80C 'packag':20B 'page':42B,90C 'perform':105C 'plugin':4A,26B,69C 'role':99C 'run':56B 'script':57B,110C 'site':109C 'store':9A,51B,106C 'unescap':5A 'url':7A,33B,76C 'user':49B,96C,113C 'visitor':62B 'wordpress':3A,21B,25B,68C 'xss':10A","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Firelight Lightbox plugin before 2.3.23 that use its Classic lightbox. Exposure needs a contributor-level account on the site and a visitor who clicks a crafted link; sites without the plugin or with a patched version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118165","severity":null,"published_at":"2026-10-30T06:16:47+00:00","modified_at":"2026-10-30T06:16:47+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","fetched_at":"2026-10-30T06:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}