Stored Cross-Site Scripting Vulnerability in WordPress Plugins Affected by SimpleLightbox Library

CVE-2024-5878

What is CVE-2024-5878?

Multiple plugins for WordPress are found to be susceptible to stored cross-site scripting (XSS) through the use of the SimpleLightbox JavaScript library version 2.1.5. This vulnerability arises from inadequate sanitization of user-supplied input and insufficient escaping of outputs related to the attributes used within the plugins. An attacker who has contributor-level access or higher can exploit this weakness by injecting malicious web scripts into pages. When users access the compromised pages, these scripts will execute in their browsers, potentially leading to unauthorized data access or other malicious actions.

References