CVE-2026-124649 · Package
NO FIX YET · SEE WHAT TO DO
The Lightbox with PhotoSwipe WordPress plugin inserts link titles and caption sources into image lightbox captions without sanitising them. An unauthenticated visitor who posts a comment can store script that runs in other visitors' browsers.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Lightbox with PhotoSwipe WordPress plugin before 5.19.0 are exposed when visitors can post comments that appear on pages with lightbox images. Sites without the plugin, or running 5.19.0 or later, are not affected. The sources do not say whether the comment-only path requires a particular comment setting.
Not affected if plugin-absent, version-5.19.0-or-later
Who cares lightbox-with-photoswipe, wordpress, wordpress-plugin
wp-content/plugins/ for the Lightbox with PhotoSwipe plugin.5.19.0.5.19.0 or later.The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.