---
id: "CVE-2026-124649"
page: "https://infrastack.ai/live/CVE-2026-124649"
kind: "vulnerability"
aliases: ["CVE-2026-124649"]
title: "WordPress Lightbox with PhotoSwipe plugin: comments can inject stored scripts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["lightbox-with-photoswipe", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-absent", "version-5.19.0-or-later"]
published_at: "2026-11-14T07:17:19+00:00"
first_seen_at: "2026-11-14T07:27:45+00:00"
updated_at: "2026-11-14T07:28:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124649", "first_seen_at": "2026-11-14T07:27:45+00:00"}]
exploit_sources: []
---

# WordPress Lightbox with PhotoSwipe plugin: comments can inject stored scripts

Link for people: https://infrastack.ai/live/CVE-2026-124649 (this .md is for agents)

The Lightbox with PhotoSwipe WordPress plugin inserts link titles and caption sources into image lightbox captions without sanitising them. An unauthenticated visitor who posts a comment can store script that runs in other visitors' browsers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Lightbox with PhotoSwipe plugin.
- Confirm whether the installed version is below `5.19.0`.

## Fix

- Lightbox with PhotoSwipe: update to `5.19.0` or later.

## Timeline

- 2026-11-14T07:27:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124649

## From the sources

The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_