Public vulnerability disclosure
CVE-2026-118438
CVE-2026-118438
publishedCWE-79
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
Technical severity6.8 mediumCVSS 3.1 · NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Published2026-10-31Source updated 2026-11-01
Collected2026-11-021 attributed source
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
No affected-product ranges reported in collected sources.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 6.8 medium |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.