{"id":"CVE-2026-118438","title":"Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute","summary":"The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts …","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-79"],"product":"Firelight Lightbox","affected":["firelight_lightbox < 2.3.24"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-01T17:27:37.269884Z"},"published":"2026-10-31","updated":"2026-11-01","sourceUpdated":"2026-11-01T17:34:17.139Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118438","references":[{"url":"https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/"}],"tags":["cve.org"],"epss":0.0029,"epssPercentile":0.2172,"ingestedAt":"2026-11-05T18:28:50.801Z","slug":"CVE-2026-118438","body":"## Overview\n\nThe Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.\n\n## Affected\n\n- `firelight_lightbox < 2.3.24`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}