[ CVE-2026-118165 · Published 30 Oct 2026 ]
Vulnerability in Unknown Firelight Lightbox
CVSS 6.8
EPSS <1%No fix listed yet
[ Description ]Official description
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.