CVE-2025-3649

The LightPress Lightbox WordPress plugin (versions prior to 2.3.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that the plugin fails to verify if download links point to valid, non-Javascript URLs. This allows users with at least the contributor role to inject maliciou...

CVE-2024-5425

CVE-2024-5425 affects the WP jQuery Lightbox plugin for WordPress. It allows stored XSS via the title attribute in all versions up to 1.5.4 due to insufficient input sanitization and output escaping. Exploitation requires authentication at Contributor level or higher, enabling injected scripts to...