---
id: CVE-2026-118438
title: >-
  Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src'
  Attribute
summary: >-
  The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape
  image attribute values before processing them in the browser, which could
  allow users with contributor-level access and above to inject arbitrary web
  scripts …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: Firelight Lightbox
affected:
  - firelight_lightbox < 2.3.24
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-01T17:27:37.269884Z'
published: '2026-10-31'
updated: '2026-11-01'
sourceUpdated: '2026-11-01T17:34:17.139Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118438'
references:
  - url: 'https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/'
tags:
  - cve.org
epss: 0.0029
epssPercentile: 0.2172
ingestedAt: '2026-11-05T18:28:50.801Z'
---

## Overview

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.

## Affected

- `firelight_lightbox < 2.3.24`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.