2 matches found
CVE-2025-3516
The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
5.9CVSS5.9AI score0.003EPSS
SaveExploits1References1
CVE-2025-3516 Simple Lightbox < 2.9.4 - Contributor+ Stored XSS
The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
5.9CVSS5.9AI score
SaveExploits0References3
20