CVE-2022-29455

CVE-2022-29455 Wordpress Vulnerability - XSS Cross-Site Scripting Vulnerability Location https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js Vulnerable Version = 3.5.5 versions Proof of Concept Exploit https://add your target...

CVE-2022-29455

CVE-2022-29455 Wordpress Vulnerability - XSS Cross-Site Scripting Vulnerability Location https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js Vulnerable Version Example - https://www.youtube.com/watch?v=4qvOkSbhcE...

CVE-2026-120687

The Lightbox & Modal Popup WordPress Plugin (FooBox) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 2.8.7 . The flaw stems from insufficient input sanitization and output escaping of the img alt attribute within .wp-caption containers . This allows un...

WordPress Lightbox & Modal Popup WordPress Plugin – FooBox plugin <= 2.8.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin FooBox Image Lightbox versions = 2.8.7...

CVE-2026-124649

The Lightbox with PhotoSwipe WordPress plugin, in versions prior to 5.19.0 , is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise link titles and other caption sources before they are inserted as HTML into the image lightbox capti...

EUVD-2026-125866

The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources before inserting them as HTML into the image lightbox caption, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks via comments...

CVE-2026-124434

Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumboptions shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as accoun...

CVE-2026-124434 Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions

Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumboptions shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as accoun...

EUVD-2026-119566

Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumboptions shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as accoun...

CVE-2026-124434 Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions

Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumboptions shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as accoun...

CVE-2026-124434

The Grav Lightbox Gallery plugin (versions 1.1.0 before 1.3.2) on Grav 2.x is vulnerable to a file read vulnerability. The issue arises because the plugin calls any medium method specified in the image, thumb, or thumb_options shortcode values without performing the core's allowed media action ch...

CVE-2026-124434: getgrav grav: Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or…

Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumboptions shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as accoun...

PT-2026-139950

Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as accou...

CVE-2026-85347

The FV Flowplayer Video Player WordPress plugin, in versions prior to 7.5.56.7212 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to properly sanitize and escape user-supplied input before rendering it on a page, specifically within the Text ...

CVE-2026-85347 FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the...

CVE-2026-118438

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affecte...

CVE-2026-109234

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent bbPress reply body' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WordPress Firelight Lightbox plugin < 2.3.24 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Firelight Lightbox versions 2.3.24...

CVE-2026-118438 Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affecte...

EUVD-2026-114586

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affecte...