CVE-2026-118438

The Firelight Lightbox WordPress plugin, in versions before 2.3.24 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly escape image attribute values (specifically the src attribute) before processing them in the browser. This flaw allows users with con...