CVE-2026-118438

The Firelight Lightbox WordPress plugin, prior to version 2.3.24 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly escape image attribute values before browser processing. This flaw allows users with contributor-level access or higher to inject arbit...