CVE-2026-3347

The CVE-2026-3347 entry concerns the WordPress plugin Multi Functional Flexi Lightbox . Affected versions are all up to and including 1.2, with a Stored Cross-Site Scripting (Stored XSS) vulnerability in the field arv_lb[message]. The root cause is a sanitize callback, arv_lb_options_val(), that ...

CVE-2026-3347: Improper Neutralization of Input During Web Page Generation

The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the arvlbmessage parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This is due to the arvlboptionsval sanitize callback returning...