{"id":"CVE-2026-118438","kind":"vulnerability","aliases":["CVE-2026-118438"],"related":[],"title":"Firelight Lightbox WordPress plugin: image attributes let contributors inject scripts","description":"The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.","summary":"The Firelight Lightbox WordPress plugin before 2.3.24 does not escape image attribute values before the browser processes them. A contributor-level user can inject scripts that run in the browser of anyone who views or previews the affected content.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firelight-lightbox","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-2.3.24-or-later","plugin-not-installed"],"how_to_check":"- Check the installed Firelight Lightbox plugin version in the WordPress admin plugins list or `wp plugin get firelight-lightbox --field=version` (the slug is unknown from the sources).\n- Confirm whether contributor-level or higher accounts can create or edit posts that use the plugin.","fix":"- Firelight Lightbox plugin: move to `2.3.24` or later.","status":"open","published_at":"2026-10-31T06:16:33+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","triaged_at":"2026-10-31T06:34:25+00:00","updated_at":"2026-10-31T06:34:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T06:34:25Z","model":"claude-haiku-5-5","output":{"fix":"- Firelight Lightbox plugin: move to `2.3.24` or later.","reach":"network","title":"Firelight Lightbox WordPress plugin: image attributes let contributors inject scripts","impact":"medium","summary":"The Firelight Lightbox WordPress plugin before 2.3.24 does not escape image attribute values before the browser processes them. A contributor-level user can inject scripts that run in the browser of anyone who views or previews the affected content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","firelight-lightbox","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Scripts run in visitors' and editors' browsers on the site","analyst_note":"","how_to_check":"- Check the installed Firelight Lightbox plugin version in the WordPress admin plugins list or `wp plugin get firelight-lightbox --field=version` (the slug is unknown from the sources).\n- Confirm whether contributor-level or higher accounts can create or edit posts that use the plugin.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-2.3.24-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Firelight Lightbox WordPress plugin before 2.3.24 that give contributor-level or higher accounts the ability to write content. Exposure depends on the plugin being active and on who can edit posts. Sites without the plugin, or where only trusted editors write content, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4104,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118438':13A,16A '-2026':12A,15A '2.3.24':31B,71C 'access':93C 'affect':63B,110C 'allow':87C 'anoth':104C 'anyon':57B 'arbitrari':98C 'attribut':6A,36B,77C 'browser':40B,55B,84C 'content':64B,111C 'contributor':8A,45B,91C 'contributor-level':44B,90C 'could':86C 'cve':11A,14A 'escap':34B,75C 'execut':102C 'firelight':1A,18B,26B,66C 'firelight-lightbox':17B 'host':23B 'imag':5A,35B,76C 'inject':9A,49B,97C 'let':7A 'level':46B,92C 'lightbox':2A,19B,27B,67C 'packag':20B 'plugin':4A,29B,69C 'preview':61B,108C 'process':41B,80C 'proper':74C 'run':52B 'script':10A,50B,100C 'self':22B 'self-host':21B 'user':47B,88C,105C 'valu':37B,78C 'view':59B,106C 'web':99C 'wordpress':3A,24B,28B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Firelight Lightbox WordPress plugin before 2.3.24 that give contributor-level or higher accounts the ability to write content. Exposure depends on the plugin being active and on who can edit posts. Sites without the plugin, or where only trusted editors write content, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T06:16:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118438","severity":null,"published_at":"2026-10-31T06:16:33+00:00","modified_at":"2026-10-31T06:16:33+00:00","first_seen_at":"2026-10-31T06:33:50+00:00","fetched_at":"2026-10-31T06:33:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}