---
id: "CVE-2026-118165"
kind: "vulnerability"
aliases: ["CVE-2026-118165"]
title: "Firelight Lightbox WordPress plugin: unescaped link URLs enable stored XSS"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["firelight-lightbox", "package", "wordpress"]
not_affected_if: ["classic-lightbox-unused", "plugin-version-2.3.23-or-later"]
published_at: "2026-10-30T06:16:47+00:00"
first_seen_at: "2026-10-30T06:28:39+00:00"
updated_at: "2026-10-30T06:29:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118165", "first_seen_at": "2026-10-30T06:28:39+00:00"}]
---

# Firelight Lightbox WordPress plugin: unescaped link URLs enable stored XSS

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape link URLs in its Classic lightbox before inserting them into pages as HTML. A Contributor-level user can store a crafted link that runs scripts in the browser of visitors who click it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Firelight Lightbox plugin in the WordPress admin plugins list, or `wp plugin get firelight-lightbox --field=version` if WP-CLI is available.
- Confirm whether the Classic lightbox option is used on the site.

## Fix

- Firelight Lightbox plugin: `2.3.23` or later (per the NVD description, versions before 2.3.23 are affected).

## Timeline

- 2026-10-30T06:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118165

## From the sources

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_