Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
Firelight Lightbox versions before 2.3.24 are affected, and the fix is in 2.3.24. No vendor rating or CVSS score is given in the checked facts.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 2.3.24
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Firelight Lightbox plugin for WordPress is affected. A user with contributor-level access or higher could inject malicious scripts through image attributes that run in another user's browser when they view or preview the affected content.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Unknown Firelight Lightbox
fixed in 2.3.24
References 1
Questions about CVE-2026-118438
What does this mean?
A user with Contributor-level access can inject arbitrary web scripts through an image 'src' attribute. The scripts run in the browser of another user who views or previews the affected content, which is cross-site scripting.Source: wpscan.com
Am I affected, and how do I check?
Firelight Lightbox versions before 2.3.24 are affected. To check, look at the installed Firelight Lightbox version in the plugin list or plugin details. The issue only matters when another user views or previews the affected content.Source: wpscan.com
What should I do about it?
Update Firelight Lightbox to version 2.3.24 or later, which fixes the issue.Source: wpscan.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data