Live › vulnerability › CVE-2026-118438
The Firelight Lightbox WordPress plugin before 2.3.24 does not escape image attribute values before the browser processes them. A contributor-level user can inject scripts that run in the browser of anyone who views or previews the affected content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running the Firelight Lightbox WordPress plugin before 2.3.24 that give contributor-level or higher accounts the ability to write content. Exposure depends on the plugin being active and on who can edit posts. Sites without the plugin, or where only trusted editors write content, can skip it.
No product ranges from the sources yet.
wp plugin get firelight-lightbox --field=version (the slug is unknown from the sources).2.3.24 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
This page as .md · .json · in your agent: get_signal("CVE-2026-118438")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.