{"id":"CVE-2026-124649","kind":"vulnerability","aliases":["CVE-2026-124649"],"related":[],"title":"WordPress Lightbox with PhotoSwipe plugin: comments can inject stored scripts","description":"The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.","summary":"The Lightbox with PhotoSwipe WordPress plugin inserts link titles and caption sources into image lightbox captions without sanitising them. An unauthenticated visitor who posts a comment can store script that runs in other visitors' browsers.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lightbox-with-photoswipe","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-absent","version-5.19.0-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Lightbox with PhotoSwipe plugin.\n- Confirm whether the installed version is below `5.19.0`.","fix":"- Lightbox with PhotoSwipe: update to `5.19.0` or later.","status":"open","published_at":"2026-11-14T07:17:19+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:12+00:00","updated_at":"2026-11-14T07:28:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-14T07:28:12Z","model":"claude-haiku-5-5","output":{"fix":"- Lightbox with PhotoSwipe: update to `5.19.0` or later.","reach":"internet","title":"WordPress Lightbox with PhotoSwipe plugin: comments can inject stored scripts","impact":"medium","summary":"The Lightbox with PhotoSwipe WordPress plugin inserts link titles and caption sources into image lightbox captions without sanitising them. An unauthenticated visitor who posts a comment can store script that runs in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","lightbox-with-photoswipe"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Script runs in visitors' browsers through stored comment content","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Lightbox with PhotoSwipe plugin.\n- Confirm whether the installed version is below `5.19.0`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-absent","version-5.19.0-or-later"],"who_is_affected":"Sites running the Lightbox with PhotoSwipe WordPress plugin before 5.19.0 are exposed when visitors can post comments that appear on pages with lightbox images. Sites without the plugin, or running 5.19.0 or later, are not affected. The sources do not say whether the comment-only path requires a particular comment setting.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4553,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124649':13A,16A '-2026':12A,15A '5.19.0':68C 'allow':89C 'attack':99C 'browser':60B 'caption':36B,41B,77C,88C 'comment':6A,51B,101C 'cross':96C 'cross-sit':95C 'cve':11A,14A 'html':83C 'imag':39B,86C 'inject':8A 'insert':32B,80C 'lightbox':2A,18B,27B,40B,62C,87C 'lightbox-with-photoswip':17B 'link':33B,73C 'packag':21B 'perform':93C 'photoswip':4A,20B,29B,64C 'plugin':5A,25B,31B,66C 'post':49B 'proper':71C 'run':56B 'sanitis':43B,72C 'script':10A,54B,98C 'site':97C 'sourc':37B,78C 'store':9A,53B,94C 'titl':34B,74C 'unauthent':46B,90C 'user':91C 'via':100C 'visitor':47B,59B 'without':42B 'wordpress':1A,22B,24B,30B,65C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Lightbox with PhotoSwipe WordPress plugin before 5.19.0 are exposed when visitors can post comments that appear on pages with lightbox images. Sites without the plugin, or running 5.19.0 or later, are not affected. The sources do not say whether the comment-only path requires a particular comment setting.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["lightboxwithphotoswipe","medium","package","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-124649':13A,16A '-2026':12A,15A 'comment':6A 'cve':11A,14A 'inject':8A 'lightbox':2A 'photoswip':4A 'plugin':5A 'script':10A 'store':9A 'wordpress':1A","search_b":"'browser':60B 'caption':36B,41B 'comment':51B 'imag':39B 'insert':32B 'lightbox':18B,27B,40B 'lightbox-with-photoswip':17B 'link':33B 'packag':21B 'photoswip':20B,29B 'plugin':25B,31B 'post':49B 'run':56B 'sanitis':43B 'script':54B 'sourc':37B 'store':53B 'titl':34B 'unauthent':46B 'visitor':47B,59B 'without':42B 'wordpress':22B,24B,30B 'wordpress-plugin':23B","search_c":"'5.19.0':68C 'allow':89C 'attack':99C 'caption':77C,88C 'comment':101C 'cross':96C 'cross-sit':95C 'html':83C 'imag':86C 'insert':80C 'lightbox':62C,87C 'link':73C 'perform':93C 'photoswip':64C 'plugin':66C 'proper':71C 'sanitis':72C 'script':98C 'site':97C 'sourc':78C 'store':94C 'titl':74C 'unauthent':90C 'user':91C 'via':100C 'wordpress':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124649","severity":null,"published_at":"2026-11-14T07:17:19+00:00","modified_at":"2026-11-14T07:17:19+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}